Quick answers
- Is CVE-2026-120066 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120066 being exploited in the wild.
- How severe is CVE-2026-120066?
- Medium severity, with a CVSS score of 5.3, published 2 November 2026.
- Which products and versions are affected?
- PostgreSQL psqlODBC before 18.00.0006.
- Is there a fix for CVE-2026-120066?
- Yes: fixed in psqlODBC 18.00.0006. Until then: Disable query logging when not needed, or restrict access to /tmp and monitor for unexpected symbolic links in that directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-120066 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-120066?
- Check whether you run PostgreSQL psqlODBC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: psqlODBC 18.00.0006
Disable query logging when not needed, or restrict access to /tmp and monitor for unexpected symbolic links in that directory.
Technical details
On Unix-like systems, psqlODBC creates log files in /tmp with default permissions (typically world-readable) using predictable names based on program name, user name, and process ID, and follows symbolic links when opening them. A local attacker can read log files containing query text and data from other users, or place a symbolic link at the predicted path to cause the driver to append log data to an attacker-chosen file with the victim's privileges. This is an insecure temporary file handling vulnerability (CWE-377) requiring local access with ability to write to /tmp.
Affected products
- PostgreSQL psqlODBC before 18.00.0006
Timeline
- 2026-11-02: disclosed