CVE-2026-120065
Description
A flaw was found in postgresql-odbc. When handling updatable cursors, the driver fails to properly sanitize quotation marks in column names before inserting them into internal database queries. An authenticated database user with permission to create tables, or an untrusted database server, can exploit this flaw by specifying crafted column names. This enables an attacker to manipulate SQL queries executed with the application's privileges, potentially resulting in unauthorized data modification, deletion, or information disclosure.
Statement
This vulnerability is rated as Important rather than Moderate due to its potential to allow arbitrary SQL injection within the execution context of the client application, compromising backend data integrity and confidentiality. Exploitation requires specific preconditions: the connecting client must query tables using updatable cursors, and an attacker must have privileges to define table schemas or control an untrusted database endpoint. In standard Red Hat Enterprise Linux deployments, applications typically connect to trusted database services using managed, static schemas, which significantly restricts real-world exposure.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure psqlODBC escapes double quotes in column names within generated keyset queries and positioned statements, or disable updatable cursors: upgrade to psqlODBC 18.00.0006 (or the fixed Postgresql Odbc builds), which escape double quotes in column names before embedding them in generated SQL statements, closing all 2 injection vectors (crafted column names containing double quotes, malicious database server returning crafted column metadata). Until patched, this is a concern on applications using psqlODBC with updatable cursors on tables without OIDs having auto-increment int4 columns, so set UpdatableCursors=0 in connection strings or DSNs, enforce SQL_CONCUR_READ_ONLY, and restrict table creation privileges and untrusted database server endpoints. As a compensating measure, restrict database account privileges so injected statements cannot access, modify, or drop unauthorized tables. These controls limit blast radius and contain exploitation, but they do not fix the underlying SQL injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1305 SQL Injection Prevention (Parameterized Queries) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 7.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
