CVE-2026-18893 PUBLISHED

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 04.08.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.1

Product Status

Vendor IBM
Product CockroachDB PostgreSQL for IBM VPC
Versions
  • affected from 26.2.0 to 26.2.3 (incl.)
  • affected from 25.4.0 to 25.4.12 (incl.)
  • affected from 25.2.0 to 25.2.20 (incl.)

Solutions

For CockroachDB PostgreSQL for IBM VPC, upgrade to CockroachDB 25.2.20, 25.4.12 or 26.2.3. Download the product versions from IBM Passport Advantage Online.

References

Problem Types

  • CWE-269 Improper Privilege Management CWE