CVE-2026-18546 · Infrastructure
NO FIX YET
IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to other hosts, which can be used to map the internal network or support further attacks.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects IBM CockroachDB PostgreSQL deployed on IBM Cloud VPC in the listed version ranges. The attacker must hold valid credentials on the database, so exposure depends on who has accounts. Teams running other CockroachDB builds are not named in the sources.
Not affected if no-authenticated-users, unaffected-versions
Who cares cockroachdb, ibm-cloud, postgresql-compatible, self-hosted
26.2.0 to 26.2.3, 25.4.0 to 25.4.12, 25.2.0 to 25.2.20.No fix yet, per the sources.
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.