What is CVE-2026-120065 in PostgreSQL psqlODBC?

CVE-2026-120065 is a high-severity security vulnerability identified in the PostgreSQL psqlODBC driver with a CVSS score of 7.1. For an updatable cursor over a table without OIDs that has an auto-increment int4 column, the driver uses that column to identify rows.

The issue arises because the driver places the column's name, as reported by the server, between double quotes in its keyset queries and WHERE clauses without doubling any double quote in the name. This flaw allows a column name containing a double quote to alter the generated SQL executed under the application's privileges, similar to risks discussed in vulnerabilidades de escalada local.

Who is affected by this driver vulnerability?

The vulnerability impacts any database user who has permissions to create a table that an application reads using an updatable cursor. Additionally, untrusted servers under specific SSL settings can also trigger this behavior.

Because the driver constructs statements like positioned SELECT, UPDATE, and DELETE incorrectly when double quotes are embedded in column identifiers, attackers can influence which rows are affected by data manipulation operations. This behavior resembles permissions oversight issues found in fallos de control de privilegios and related vulnerabilidades de componentes.

How can I mitigate and protect against this flaw?

To protect your systems and applications against this security flaw, you must upgrade the PostgreSQL ODBC driver immediately. Reviewing database permissions and ensuring secure SSL configurations are also crucial steps for mitigation.

You can follow these steps to secure your environment against the vulnerability described in the advisory available at [[github.com|https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-9cg8-r57h-h6jj]]:

  1. Check your current psqlODBC driver version to determine if it is earlier than 18.00.0006.
  2. Download and install the latest psqlODBC version 18.00.0006 or higher.
  3. Review user table creation privileges within your PostgreSQL database instances.
  4. Verify that SSL settings for server connections are strictly enforced and trusted.