Answer in brief
CVE-2026-120953 records a Medium severity (CVSS 5.1) vulnerability in Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler. The current sources do not mark it as known exploited. The current feed maps MongoDB/Atlas SQL JDBC Driver (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MongoDB/Atlas SQL JDBC Driver (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MongoDB/Atlas SQL JDBC Drivergeneric | >=2.1.2 <4.0.1 | 4.0.1 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
Quoted source text, attributed separately from HOL analysis.