Skip to content
CVE Tracker
Back

CVE-2026-120066

psqlODBC log files are created with default permissions at a predictable path and follow symbolic links

Medium5.3
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120066, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1Medium5.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Awaiting Analysis3.1Medium5.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. On Unix-like systems, log files are opened with mode 0600 and O_NOFOLLOW, and an existing log file is used only if it is a regular file owned by the user running the application.

Workaround: Leave Debug and CommLog disabled in production. If logging is needed, set Logdir in the driver's section of odbcinst.ini (PostgreSQL Unicode or PostgreSQL ANSI) to a directory writable only by the user running the application.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .