CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2026-120062
High (7.5). EPSS 0.4% estimated probability of exploitation activity in the next 30 days.
On this page
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.
Severity
- EPSS
- 0.4% estimated probability of exploitation activity in the next 30 days; 30th percentile. Scored 2026-11-04. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- OWASP Top 10
- A05:2025 Injection
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-120062 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120062?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120062?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-120062 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120062 |
| Ubuntu | 16.04:LTS, 18.04:LTS, 20.04:LTS and 4 more | psqlodbc | no fix listed | UBUNTU-CVE-2026-120062 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu.
Red Hat
Red Hat rates this Important.
This vulnerability is rated as an Important severity issue because successful exploitation allows an attacker to execute arbitrary database queries with the full privileges of the database connection, compromising database confidentiality and integrity. However, triggering this flaw requires an application to pass untrusted input directly to the SQLSpecialColumns catalog function, which is an uncommon implementation practice. Typical deployments of postgresql-odbc on Red Hat Enterprise Linux do not expose metadata inspection calls to end-user input, substantially limiting the attack surface in standard environments.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 6 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 7 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 8 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 9 | postgresql-odbc | Affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-120062.
Attack patterns (CAPEC)
- CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
- CAPEC-66 SQL Injection Likelihood: High · Severity: High
- CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
- CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
- CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
- CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.