CVE-2026-120066: medium-severity vulnerability in PostgreSQL psqlODBC
psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.1%
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
PostgreSQL · psqlODBCRelated CVEs — PostgreSQL psqlODBC
In the same product, most dangerous first.
CVE-2026-120062HIGHpsqlODBC SQL injection through SQLSpecialColumns table and schema namesEPSS 0.4%CVE-2026-120067MEDIUMpsqlODBC stack buffer overflow copying ctid and oid values for updatable cursorsEPSS 0.3%CVE-2026-120064HIGHpsqlODBC does not validate column numbers and row indexes in binding and descriptor functionsEPSS 0.3%CVE-2026-120061HIGHpsqlODBC ODBC escape parser stack buffer overflowEPSS 0.3%CVE-2026-120065HIGHpsqlODBC does not escape a server-supplied column name in its updatable-cursor queriesEPSS 0.3%CVE-2026-120063MEDIUMpsqlODBC stack buffer overflow when quoting long schema and table namesEPSS 0.3%