CVE-2026-120066Medium· 5.3▾ SunlitOn Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. On Unix-like systems, log files are opened with mode 0600 and O_NOFOLLOW, and an existing log file is used only if it is a regular file owned by the user running the application.
Leave Debug and CommLog disabled in production. If logging is needed, set Logdir in the driver's section of odbcinst.ini (PostgreSQL Unicode or PostgreSQL ANSI) to a directory writable only by the user running the application.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120062High· 7.5psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120065High· 7.1psqlODBC does not escape a server-supplied column name in its updatable-cursor queries