{"id":"CVE-2026-18546","kind":"vulnerability","aliases":["CVE-2026-18546"],"related":[],"title":"IBM CockroachDB PostgreSQL for IBM VPC: SSRF lets an authenticated user probe internal networks","description":"IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.","summary":"IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to other hosts, which can be used to map the internal network or support further attacks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cockroachdb","ibm-cloud","infrastructure","postgresql-compatible","self-hosted"],"not_affected_if":["no-authenticated-users","unaffected-versions"],"how_to_check":"- Check the installed version of IBM CockroachDB PostgreSQL for IBM VPC against the affected ranges: `26.2.0` to `26.2.3`, `25.4.0` to `25.4.12`, `25.2.0` to `25.2.20`.","fix":null,"status":"open","published_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:55+00:00","updated_at":"2026-11-08T18:22:55+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM CockroachDB PostgreSQL for IBM VPC: SSRF lets an authenticated user probe internal networks","impact":"medium","summary":"IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to other hosts, which can be used to map the internal network or support further attacks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cockroachdb","ibm-cloud","postgresql-compatible","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server sends requests to internal hosts, enabling network enumeration","analyst_note":"Confirm the fixed version and any IBM bulletin for CVE-2026-18546; sources only give the affected ranges.","how_to_check":"- Check the installed version of IBM CockroachDB PostgreSQL for IBM VPC against the affected ranges: `26.2.0` to `26.2.3`, `25.4.0` to `25.4.12`, `25.2.0` to `25.2.20`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-versions","no-authenticated-users"],"who_is_affected":"Affects IBM CockroachDB PostgreSQL deployed on IBM Cloud VPC in the listed version ranges. The attacker must hold valid credentials on the database, so exposure depends on who has accounts. Teams running other CockroachDB builds are not named in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000786,"input_tokens":4622,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18546':17A,20A '-2026':16A,19A '25.2.0':46B,97C '25.2.20':48B,99C '25.4.0':42B,93C '25.4.12':44B,95C '26.2.0':39B,90C '26.2.3':41B,92C 'allow':111C 'attack':61B,83B,114C,130C 'authent':10A,113C 'cloud':24B 'cockroachdb':2A,21B,33B,85C 'compat':28B 'cve':15A,18A 'enumer':126C 'facilit':128C 'flaw':56B 'forgeri':55B,107C 'host':31B,70B 'ibm':1A,5A,23B,32B,36B,84C,88C 'ibm-cloud':22B 'infrastructur':25B 'intern':13A,78B 'lead':123C 'let':8A 'log':59B 'logged-in':58B 'make':63B 'map':76B 'may':110C 'network':14A,79B,125C 'postgresql':3A,27B,34B,86C 'postgresql-compat':26B 'potenti':122C 'probe':12A 'request':54B,67B,106C,118C 'self':30B 'self-host':29B 'send':66B,116C 'server':52B,65B,104C 'server-sid':51B,103C 'side':53B,105C 'ssrf':7A,108C 'support':81B 'system':121C 'unauthor':117C 'use':74B 'user':11A 'version':38B 'vpc':6A,37B,89C 'vulner':101C","nicknames":[],"mitigations":[],"who_affected":"Affects IBM CockroachDB PostgreSQL deployed on IBM Cloud VPC in the listed version ranges. The attacker must hold valid credentials on the database, so exposure depends on who has accounts. Teams running other CockroachDB builds are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cockroachdb","ibmcloud","infrastructure","medium","postgresqlcompatible","selfhosted"],"campaign_type":null,"search_a":"'-18546':17A,20A '-2026':16A,19A 'authent':10A 'cockroachdb':2A 'cve':15A,18A 'ibm':1A,5A 'intern':13A 'let':8A 'network':14A 'postgresql':3A 'probe':12A 'ssrf':7A 'user':11A 'vpc':6A","search_b":"'25.2.0':46B '25.2.20':48B '25.4.0':42B '25.4.12':44B '26.2.0':39B '26.2.3':41B 'attack':61B,83B 'cloud':24B 'cockroachdb':21B,33B 'compat':28B 'flaw':56B 'forgeri':55B 'host':31B,70B 'ibm':23B,32B,36B 'ibm-cloud':22B 'infrastructur':25B 'intern':78B 'log':59B 'logged-in':58B 'make':63B 'map':76B 'network':79B 'postgresql':27B,34B 'postgresql-compat':26B 'request':54B,67B 'self':30B 'self-host':29B 'send':66B 'server':52B,65B 'server-sid':51B 'side':53B 'support':81B 'use':74B 'version':38B 'vpc':37B","search_c":"'25.2.0':97C '25.2.20':99C '25.4.0':93C '25.4.12':95C '26.2.0':90C '26.2.3':92C 'allow':111C 'attack':114C,130C 'authent':113C 'cockroachdb':85C 'enumer':126C 'facilit':128C 'forgeri':107C 'ibm':84C,88C 'lead':123C 'may':110C 'network':125C 'postgresql':86C 'potenti':122C 'request':106C,118C 'send':116C 'server':104C 'server-sid':103C 'side':105C 'ssrf':108C 'system':121C 'unauthor':117C 'vpc':89C 'vulner':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18546","severity":null,"published_at":"2026-11-08T18:17:04+00:00","modified_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}