Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-18893 (GCVE-0-2026-18893)

Vulnerability from cvelistv5 – Published: 2026-11-08 18:08 – Updated: 2026-11-09 21:06

Title

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Summary

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 21:05 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7293292	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	CockroachDB PostgreSQL for IBM VPC	Affected: 26.2.0 , ≤ 26.2.3 (semver) Affected: 25.4.0 , ≤ 25.4.12 (semver) Affected: 25.2.0 , ≤ 25.2.20 (semver) cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:26.2.3:::::::* cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:26.2.0:::::::* cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.4.12:::::::* cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.4.0:::::::* cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.2.20:::::::* cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.2.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:05:41.246694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:06:51.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:26.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:26.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.4.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.2.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:25.2.0:*:*:*:*:*:*:*"
          ],
          "product": "CockroachDB PostgreSQL for IBM VPC",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "26.2.3",
              "status": "affected",
              "version": "26.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.4.12",
              "status": "affected",
              "version": "25.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.2.20",
              "status": "affected",
              "version": "25.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eIBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is\u003c/span\u003e\u0026nbsp;vulnerable to privilege escalation via user-defined function.\u003c/p\u003e"
            }
          ],
          "value": "IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is\u00a0vulnerable to privilege escalation via user-defined function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T18:08:42.430Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7293292"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor CockroachDB PostgreSQL for IBM VPC, upgrade to CockroachDB 25.2.20, 25.4.12 or 26.2.3. Download the product versions from\u00a0\u003ca href=\"https://www.ibm.com/software/passportadvantage/pao_customer.html\" rel=\"noopener noreferrer nofollow\"\u003eIBM Passport Advantage Online\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "For CockroachDB PostgreSQL for IBM VPC, upgrade to CockroachDB 25.2.20, 25.4.12 or 26.2.3. Download the product versions from IBM Passport Advantage Online."
        }
      ],
      "title": "CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18893",
    "datePublished": "2026-11-08T18:08:16.406Z",
    "dateReserved": "2026-08-04T19:50:01.095Z",
    "dateUpdated": "2026-11-09T21:06:51.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18546 (GCVE-0-2026-18546)

Vulnerability from cvelistv5 – Published: 2026-11-08 18:05 – Updated: 2026-11-08 18:07