Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-120066: psqlODBC logs can be read or redirected by others
CVE-2026-120066 · published 2 days ago
Summary
The psqlODBC driver on Unix-like systems writes its log files to a predictable location in the /tmp folder with default permissions that make them readable by anyone. Because the file name and path are known, another user on the same machine can view another user's query details or place a symbolic link so the driver writes logs into a file the attacker controls. Update to version 18.00.0006 or later, or change the log location and permissions to restrict access.
What to do
- Update postgresql psqlodbc to version 18.00.0006 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | postgresql | psqlodbc | < 18.00.0006 |
| Ubuntu:16.04:LTS | canonical | psqlodbc | All versions |
Original advisory text
psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
References
- https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-wj7r-... Third Party Advisory
- https://ubuntu.com/security/CVE-2026-120066 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-120066 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-59Link Following
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Track software like this
Free during beta