UBUNTU-CVE-2026-120065: High severity ubuntu/psqlodbc vulnerability
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using psqlODBC before 18.00.0006 are exposed when an application uses an updatable cursor on a table without OIDs that includes an auto-increment int4 column. Exploitation also requires the application to read a table created by an untrusted database user, or to connect to a server that is not trusted under the current SSL settings.
What access does an attacker need?
An attacker needs to be able to create a table that the application reads through an updatable cursor, allowing them to choose a column name containing a double quote. Alternatively, an untrusted server accepted by the application's current SSL configuration can provide the malicious column name.
What can an attacker do through this flaw?
The malformed quoted column name can alter SQL issued by the driver with the application's database privileges. This can affect which rows are selected, updated, or deleted by positioned operations.
How can I determine whether my application is affected?
Check whether the installed psqlODBC version is earlier than 18.00.0006. Then identify applications that use updatable cursors against tables without OIDs and with auto-increment int4 columns, particularly where untrusted users can create readable tables or where SSL settings permit untrusted servers.