Several PostgreSQL ODBC flaws allow SQL injection and security bypass
French cyber agency CERT-FR warned on 3 November 2026 about several security flaws in PostgreSQL ODBC, the driver that lets software connect to PostgreSQL databases. The flaws could allow SQL injection, which means an attacker can slip commands into database queries, and a bypass of security rules. Users should install version 18.00.0006 or later, as described in the vendor's 2 November 2026 security bulletin.
This summary was generated by AI; the official source prevails.
What does it mean?
If your software connects to a PostgreSQL database through the ODBC driver, that driver has security holes. An attacker could use them to sneak harmful commands into database requests or get around some protections. Updating the driver to version 18.00.0006 or later closes these holes.
Who is affected?
Organizations and developers running PostgreSQL ODBC versions earlier than 18.00.0006.