CVE-2026-126823: Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir
A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Java applications using the Atlas SQL JDBC driver on a host where an ordinary local user can write to the shared temporary location used by the driver's native library loader are exposed. The attacker must be on the same host.
What does an attacker need to exploit it?
The attacker needs an ordinary local account and the ability to place a file named libmongosqltranslate.so in the shared temporary location before the application loads the JDBC driver class. No user interaction is required once the vulnerable loading path is reached.
What is the impact if exploitation succeeds?
The attacker's code can run inside the Java application process. This can disclose or alter data available to that process, or make the process unavailable.
How can exposure be reduced before a fix is available?
Restrict untrusted local users' ability to write to the shared temporary location used by the driver, and avoid using a shared writable temporary directory for processes that load the driver. Ensure a pre-existing libmongosqltranslate.so cannot be planted there by another user.