CVSS 3.1
5.3 mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:NCVE-2026-120066
Medium (5.3). EPSS 0.1% estimated probability of exploitation activity in the next 30 days.
On this page
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
Severity
- EPSS
- 0.1% estimated probability of exploitation activity in the next 30 days; 1st percentile. Scored 2026-11-04. A forecast for this CVE across the internet, not for your own systems.
- CWEs
- CWE-59 Improper Link Resolution Before File Access (Link Following)
CWE-732 Incorrect Permission Assignment for Critical Resource - OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-120066 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120066?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120066?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-120066 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120066 |
| Ubuntu | 16.04:LTS, 18.04:LTS, 20.04:LTS and 4 more | psqlodbc | no fix listed | UBUNTU-CVE-2026-120066 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu.
Red Hat
Red Hat rates this Moderate.
Red Hat rates this vulnerability as having a Moderate impact because exploitation requires local system access and logging is not enabled by default in standard configurations. Under typical Red Hat Enterprise Linux deployments, diagnostic tracing in the PostgreSQL ODBC driver must be explicitly activated by an administrator or user. Furthermore, standard RHEL kernel protections against symlink traversal in sticky world-writable directories limit arbitrary file tampering, confining the residual risk to potential information disclosure of queries when debug tracing is turned on.
Disable driver logging in ODBC configurations.
1. Ensure that logging options are disabled in the system-wide `/etc/odbc.ini` or user-specific `~/.odbc.ini` configuration files by setting:
```ini
CommLog = 0
Debug = 0
```
Alternatively, ensure connection strings passed by client applications do not enable `CommLog` or `Debug`.
2. Caveat: Disabling these parameters prevents generating diagnostic traces and communication logs, which may hinder troubleshooting PostgreSQL database connection issues.
3. Warning: Applications holding active ODBC database connections must be restarted for configuration changes to take effect.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql-odbc | Fix deferred | |
| Red Hat Enterprise Linux 6 | postgresql-odbc | Out of support scope | |
| Red Hat Enterprise Linux 7 | postgresql-odbc | Fix deferred | |
| Red Hat Enterprise Linux 8 | postgresql-odbc | Fix deferred | |
| Red Hat Enterprise Linux 9 | postgresql-odbc | Fix deferred |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-120066.
Attack patterns (CAPEC)
- CAPEC-17 Using Malicious Files Likelihood: High · Severity: Very High
- CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
- CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
- CAPEC-132 Symlink Attack Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-732 (11).