Vulnerability · Published Nov 2, 2026 · Assigned by PostgreSQL
CVE-2026-120062psqlODBC SQL injection through SQLSpecialColumns table and schema names
High 7.5
In plain English
A high-severity SQL injection in psqlODBC from PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120062 |
| Debian:13 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120062 |
| Debian:14 | psqlodbc | 1:18.00.0006-1 | DEBIAN-CVE-2026-120062 |
| Ubuntu:22.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120062 |
| Ubuntu:24.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120062 |
| Ubuntu:26.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120062 |
| Ubuntu:26.10 | psqlodbc | no fix listed | UBUNTU-CVE-2026-120062 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PostgreSQL | psqlODBC | 0 – before 18.00.0006 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H