CVE-2026-18546 PUBLISHED

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 31.07.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor IBM
Product CockroachDB PostgreSQL for IBM VPC
Versions
  • affected from 26.2.0 to 26.2.3 (incl.)
  • affected from 25.4.0 to 25.4.12 (incl.)
  • affected from 25.2.0 to 25.2.20 (incl.)

Solutions

For CockroachDB PostgreSQL for IBM VPC, upgrade to CockroachDB 25.2.20, 25.4.12 or 26.2.3. Download the product versions from  IBM Passport Advantage Online https://www.ibm.com/software/passportadvantage/pao_customer.html .

References

Problem Types

  • CWE-918 Server-Side Request Forgery (SSRF) CWE