CVE-2026-120066 psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-120066?
CVE-2026-120066 is a medium-severity vulnerability in PostgreSQL psqlODBC, published on 2 Nov 2026.
Official description
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
Which versions are affected by CVE-2026-120066?
How do I fix CVE-2026-120066?
Upgrade to a fixed version.
Is CVE-2026-120066 being exploited?
There is no known exploitation of CVE-2026-120066 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-120066, GHSA-rvv3-vcvv-5fqj, GHSA-wj7r-6pj3-62g8, UBUNTU-CVE-2026-120066.