CVE-2026-120062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120062", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-30T19:25:18.919Z", "datePublished": "2026-11-02T19:09:12.214Z", "dateUpdated": "2026-11-02T19:35:38.418Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:12.214Z"}, "title": "psqlODBC SQL injection through SQLSpecialColumns table and schema names", "datePublic": "2026-11-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected."}], "affected": [{"vendor": "PostgreSQL", "product": "psqlODBC", "repo": "https://github.com/postgresql-interfaces/psqlodbc", "programFiles": ["info.c"], "programRoutines": [{"name": "PGAPI_SpecialColumns"}, {"name": "findPrimaryOrUnique"}], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "18.00.0006", "status": "affected", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Validate table and schema names against the catalog, or reject names containing quote characters or backslashes, before calling SQLSpecialColumns."}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. SQLSpecialColumns passes the escaped names to its catalog queries, as the other catalog functions do."}], "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33", "tags": ["vendor-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:35:26.571009Z", "id": "CVE-2026-120062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:35:38.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T19:35:26.571009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:35:33.300Z"}}], "cna": {"title": "psqlODBC SQL injection through SQLSpecialColumns table and schema names", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "product": "psqlODBC", "versions": [{"status": "affected", "version": "0", "lessThan": "18.00.0006", "versionType": "custom"}], "programFiles": ["info.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "PGAPI_SpecialColumns"}, {"name": "findPrimaryOrUnique"}]}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. SQLSpecialColumns passes the escaped names to its catalog queries, as the other catalog functions do."}], "datePublic": "2026-11-02T00:00:00.000Z", "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Validate table and schema names against the catalog, or reject names containing quote characters or backslashes, before calling SQLSpecialColumns."}], "descriptions": [{"lang": "en", "value": "SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:12.214Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120062", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:35:38.418Z", "dateReserved": "2026-10-30T19:25:18.919Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-11-02T19:09:12.214Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "psqlODBC", "programFiles": ["info.c"], "programRoutines": [{"name": "PGAPI_SpecialColumns"}, {"name": "findPrimaryOrUnique"}], "repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "versions": [{"lessThan": "18.00.0006", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected."}], "id": "CVE-2026-120062", "lastModified": "2026-11-02T20:17:39.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:35:26.571009Z", "version": "2.0.3"}}]}, "published": "2026-11-02T19:18:03.423", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql-odbc: postgresql-odbc: arbitrary SQL execution via unescaped input in SQLSpecialColumns", "id": "2565363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565363"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-89", "details": ["A flaw was found in postgresql-odbc. When an application passes untrusted table or schema names to the SQLSpecialColumns catalog function, the driver fails to properly escape the input before concatenating it into internal database queries. An attacker able to supply crafted input can execute arbitrary Structured Query Language (SQL) commands with the privileges of the active database connection, potentially leading to unauthorized data disclosure or modification."], "name": "CVE-2026-120062", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-02T19:09:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120062\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120062\nhttps://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.00.0006)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "psqlODBC", "source": "cna", "vendor": "PostgreSQL"}, "product": "psqlodbc", "vendor": "postgresql"}], "created": "2026-11-02T20:45:07.021338+00:00", "updated": "2026-11-02T20:45:07.597890+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$psqlodbc"]}