Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120065— psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

对于没有 OID 且包含自增 int4 列的表，若其上启用了可更新游标，psqlODBC 会使用该列来标识行。在生成键集查询以及定位 SELECT、UPDATE 和 DELETE 语句的 WHERE 子句时，驱动会将服务器报告的列名置于双引号之间，但不会对列名中已存在的双引号进行转义（即未将双引号加倍）。因此，若列名中包含双引号，将会改变驱动程序以应用程序权限执行的 SQL 语句，进而影响定位更新或删除操作所作用的具体行。任何能够创建被应用程序通过可更新游标读取的表的用户，均可构造此类列名；同样，在当前 SSL 配

CVSS 7.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120065

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
Source: CVE Program / CVE List V5
Vulnerability Description
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120065

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120065

请登录查看更多情报信息。

Other References for CVE-2026-120065 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061 7.5 HIGH psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120064 7.5 HIGH psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120059 6.8 MEDIUM psqlODBC uses a server-supplied column name as a format string
CVE-2026-120060 5.9 MEDIUM psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120067 5.9 MEDIUM psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-89