Read the docs
TI-2026-83951 Aliases CVE-2026-120066GHSA-rvv3-vcvv-5fqj

psqlODBC log files use weak permissions and follow symbolic links

Priority LOW 23CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

When logging is enabled on Unix-like systems, psqlODBC before 18.00.0006 creates its log files in /tmp at a predictable path with default permissions, typically world-readable. The driver also follows symbolic links when it opens these files (CWE-59). A local user can read query text and data from another user's logs, or redirect log writes to a file of their choice with the victim's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix Partial psqlODBC (PostgreSQL): 18.00.0006Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpsqlODBCbefore 18.00.000618.00.0006Patch availableCNA
  • psqlODBC VendorPostgreSQL Affected before 18.00.0006 Fixed in 18.00.0006 Patch available CNA

Remediation

Upgrade psqlODBC to 18.00.0006 or later. Red Hat lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as affected without a fix, with no fix planned for Red Hat Enterprise Linux 6 and no plan available for the others.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA psqlODBC (PostgreSQL) Fixed in 18.00.0006

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL psqlODBC 18.00.0006

    11 records Highest priority Priority LOW 11 LOW

    Other records, highest priority first

    • TI-2026-83949 Out-of-bounds access in psqlODBC via unchecked column and row numbersPriority LOW 35
    • TI-2026-83947 SQL injection in psqlODBC SQLSpecialColumns table and schema namesPriority LOW 35
    • TI-2026-83946 Stack buffer overflow in psqlODBC ODBC escape parserPriority LOW 35
    Show all 11 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120066
  2. 2026-11-02 CISA SSVC decision points changed
  3. 2026-11-02 Alias added: GHSA-rvv3-vcvv-5fqj
  4. 2026-11-03 Affected versions changed · Red Hat
  5. 2026-11-03 CVSS score added · Red Hat

References

Advisory 1

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences