EUVD-2026-115375Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with application-level connection
-
ExploitSubmit crafted table/schema name to SQLSpecialColumns
-
ExecutionDriver splices name unescaped into catalog query
-
ImpactExecute arbitrary SQL at connection privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a host application that passes an attacker-controlled (untrusted) table or schema name into the psqlODBC SQLSpecialColumns function; only that function is affected, because the other catalog functions escape these identifiers. Applications that pass only trusted or hardcoded identifiers to SQLSpecialColumns are not exploitable. Exploitation is limited to psqlODBC versions before 18.00.0006, and the injected SQL runs only with the privileges of the existing database connection (per CVSS PR:L, an authenticated connection context). The only complete fix per the advisory is updating to 18.00.0006. |
| Impact | Signals are moderate and partly conditional. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:H, base 7.5) reflects a SQL injection (CWE-89) that yields arbitrary SQL execution at the connection's privilege level, but two metrics temper real-world risk: AC:H and PR:L indicate the attack is neither trivial nor fully unauthenticated, and - critically - exploitation depends on an application actually passing untrusted input to the specific SQLSpecialColumns function. No EPSS score was provided, there is no CISA KEV listing, and no confirmed public exploit code exists; the single reference is a PostgreSQL/GHSA vendor advisory, not a PoC. The vuln.today decision label is 'this_week' rather than act_now/emergency, which is consistent with a credible-but-not-actively-exploited library flaw. Net: this is a legitimate issue to remediate on a near-term schedule, not a drop-everything emergency, and its exploitability is gated by whether downstream applications feed attacker-controlled table/schema names into this one driver function. |
| Exploit ScenarioDerived | An application using psqlODBC exposes a feature that passes a user-supplied table or schema name to the SQLSpecialColumns function. An attacker with a valid connection submits a crafted identifier containing SQL syntax, which the driver splices unescaped into its catalog query, causing arbitrary SQL to run with the privileges of the database connection. No public exploit code has been identified for this flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
SQL injection in psqlODBC before 18.00.0006 allows an attacker who can influence a table or schema name passed by a host application to SQLSpecialColumns to execute arbitrary SQL with the privileges of the existing database connection. Only SQLSpecialColumns is affected because it fails to escape these identifiers, while the other catalog functions do escape them; applications that pass only trusted or hardcoded identifiers to that function are not exploitable. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit was identified at time of analysis.
RemediationAI
Update psqlODBC to 18.00.0006, which the vendor advisory identifies as the only complete fix (https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33). Until the update is applied, applications should ensure that table and schema names passed to SQLSpecialColumns are trusted or hardcoded, or avoid passing untrusted identifiers to that function where possible; this reduces exposure but limits application flexibility and is not a substitute for the vendor fix. No other vendor-listed workaround is provided in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
psqlODBC is the PostgreSQL ODBC driver, and SQLSpecialColumns is an ODBC catalog function that returns information about columns that uniquely identify a row. In affected versions, SQLSpecialColumns splices the supplied table and schema names directly into its catalog query without escaping them, whereas the other catalog functions escape those identifiers, producing a CWE-89 SQL injection. CPE data identifies postgresql:psqlodbc across versions before 18.00.0006 as affected. Exploitation requires a host application that passes an attacker-controlled table or schema name into SQLSpecialColumns; the injected SQL runs only with the privileges of the existing connection, consistent with the low-privilege authenticated context in the assessed vector. The supplied sources do not describe additional trigger mechanics beyond this application-level precondition.
Know when Psqlodbc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Arbitrary SQL at connection privileges gives C/I/A:H; AC:H because it depends on an app feeding untrusted input to this one function, PR:L for the authenticated connection.
Primary rating from Vendor (PostgreSQL).
CVSS VectorVendor: PostgreSQL
Lifecycle Timeline
2DescriptionCVE.org
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.
Executive ViewAI
A high-severity SQL injection vulnerability in psqlODBC, the PostgreSQL ODBC driver, could allow attackers to execute arbitrary SQL with the privileges of the existing database connection. This affects organizations using psqlODBC in applications that pass untrusted table or schema names to the SQLSpecialColumns function. Leadership should prioritize remediation because exploitation could lead to unauthorized data access or modification, though no public exploit or active exploitation has been identified.
Vendor-released patch: 18.00.0006
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Out-of-bounds reads and writes in psqlODBC before 18.00.0006 arise when a host application forwards untrusted column num
A stack-based buffer overflow (CWE-121) in the psqlODBC driver, the official PostgreSQL ODBC driver, lets attacker-influ
Heap out-of-bounds write in the psqlODBC driver (CWE-787) affects all versions before 18.00.0006 and is reachable only w
A heap buffer overflow in psqlODBC's large-object read path lets a malicious or man-in-the-middle PostgreSQL server over
SQL injection in psqlODBC before 18.00.0006 can let an authenticated database user who can create a table that an applic
Format-string handling in psqlODBC before 18.00.0006 can crash applications or disclose client memory when an updatable
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more
A stack-based buffer overflow in psqlODBC, the PostgreSQL ODBC driver, affects all releases before 18.00.0006 when updat
Stack buffer over-write in psqlODBC before 18.00.0006 can corrupt an application process that forwards attacker-influenc
Client-side crash and limited out-of-bounds read affect psqlODBC before 18.00.0006 when the driver connects to a Postgre
psqlODBC before 18.00.0006 on Unix-like systems can expose query text and data to other local users when logging is enab
Exploit-DB