Atlas SQL JDBC Driver EUVD-2026-116142

Exploitation requires that a user, during an interactive sign-in flow, actively elects to connect the Atlas SQL JDBC Driver to an endpoint controlled by the attacker; the driver then accepts endpoint addresses from that remote endpoint without validating their scheme and forwards them to the local default protocol handler. The required conditions are therefore: (1) use of the interactive sign-in flow, and (2) the victim choosing to connect to an attacker-controlled or compromised endpoint. Limiting factors: mandatory user interaction (UI:A) and the social-engineering dependency on the victim selecting a hostile endpoint; impact is confined to opening an attacker-chosen address with low integrity impact and no confidentiality or availability impact. The precise message or field carrying the malicious address is not described in the available sources.

This is a moderate, not high, priority. The only quantitative severity signal provided is the vendor's CVSS 4.0 vector (5.1, Medium): AV:N/AC:L/AT:N/PR:N/UI:A with only low integrity impact (VI:L) and no confidentiality, availability, or subsequent-system impact. The combination of unauthenticated network vector (PR:N) but required user interaction (UI:A) and the limited VI:L impact is internally consistent with an open-redirect/URI-handler abuse (CWE-601) rather than code execution or data theft. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied, so there is no evidence of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with a patch-on-normal-cadence posture rather than emergency action. Net: a genuine but low-consequence social-engineering-dependent issue - its real-world risk is bounded by the need for a user to actively choose to connect to an attacker-controlled endpoint, so it is best treated as a standard-priority fix, not a drop-everything emergency.

An attacker stands up or compromises a MongoDB Atlas SQL endpoint and entices a victim to point the Atlas SQL JDBC Driver at it and begin an interactive sign-in. During that flow the malicious endpoint returns an endpoint address of the attacker's choosing, which the driver hands to the local default protocol handler, causing an arbitrary address (e.g. a crafted URL or local protocol URI) to open on the victim's machine. No public exploit code was identified in the provided sources; the exact triggering message is not described in the available sources.