CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2026-120065
High (7.1). EPSS 0.3% estimated probability of exploitation activity in the next 30 days.
On this page
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.
Severity
- EPSS
- 0.3% estimated probability of exploitation activity in the next 30 days; 22nd percentile. Scored 2026-11-04. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- OWASP Top 10
- A05:2025 Injection
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-120065 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120065?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120065?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-120065 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120065 |
| Ubuntu | 16.04:LTS, 18.04:LTS, 20.04:LTS and 4 more | psqlodbc | no fix listed | UBUNTU-CVE-2026-120065 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu.
Red Hat
Red Hat rates this Important.
This vulnerability is rated as Important rather than Moderate due to its potential to allow arbitrary SQL injection within the execution context of the client application, compromising backend data integrity and confidentiality. Exploitation requires specific preconditions: the connecting client must query tables using updatable cursors, and an attacker must have privileges to define table schemas or control an untrusted database endpoint. In standard Red Hat Enterprise Linux deployments, applications typically connect to trusted database services using managed, static schemas, which significantly restricts real-world exposure.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 6 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 7 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 8 | postgresql-odbc | Affected | |
| Red Hat Enterprise Linux 9 | postgresql-odbc | Affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-120065.
Attack patterns (CAPEC)
- CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
- CAPEC-66 SQL Injection Likelihood: High · Severity: High
- CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
- CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
- CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
- CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.