Skip to content
CVE Tracker
Back

CVE-2026-120062

psqlODBC SQL injection through SQLSpecialColumns table and schema names

High7.5
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120062, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Awaiting Analysis3.1High7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. SQLSpecialColumns passes the escaped names to its catalog queries, as the other catalog functions do.

Workaround: Validate table and schema names against the catalog, or reject names containing quote characters or backslashes, before calling SQLSpecialColumns.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .