MongoDB Atlas SQL ODBC Driver vulnerabilities

Latest MongoDB Atlas SQL ODBC Driver CVEs

Newest publication first

1. CVE-2026-120952 MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write

   Published 2026-11-03

   Medium·CVSS 6.0 EPSS 0.36%

   An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defi...

2. CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

   Published 2026-08-12

   Medium·CVSS 6.3 EPSS 0.20%

   MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have...

3. CVE-2025-11575 MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories

   Published 2025-10-23

   High·CVSS 8.8 EPSS 0.14%

   Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.