Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120953— Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

Quick assessment

Affected
MongoDB Atlas SQL JDBC Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Atlas SQL JDBC 驱动程序的身份验证组件中存在 URI 重定向漏洞。在交互式登录流程中，该驱动程序会接受其指向的远程端点提供的端点地址，且未对地址的协议方案（scheme）进行验证，随后将生成的地址传递给本地默认协议处理器。若攻击者能够控制用户选择连接的端点，则可在无需身份验证的情况下，诱使用户系统打开攻击者指定的地址；此攻击需要用户交互才能成功。

CVSS 4.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB Atlas SQL JDBC Driver 2.1.2< 4.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120953

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
Source: CVE Program / CVE List V5
Vulnerability Description
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Atlas SQL JDBC Driver 2.1.2 ~ 4.0.1 -

II. Public POCs for CVE-2026-120953

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120953

请登录查看更多情报信息。

Vendor Pages for CVE-2026-120953 (1)

Other References for CVE-2026-120953 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956 7.1 HIGH remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-120952 7.1 HIGH MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-119179 7.0 HIGH MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120673 5.5 MEDIUM Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567 5.4 MEDIUM ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672 4.8 MEDIUM mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959 3.7 LOW MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same vendor: MongoDB
Same weakness: CWE-601