COCKROACHDB POSTGRESQL FOR IBM VPC · CVE-2026-18893 · Vendor
FIX → 26.2.3 · 25.4.12 +1 ✓ verified
IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 can be abused to escalate privileges through a user-defined function. An attacker with a database account could gain rights beyond what they were granted.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running CockroachDB PostgreSQL for IBM VPC on versions before 25.2.20, 25.4.12 or 26.2.3. An attacker needs a database account (local, low privilege) and can use a user-defined function to gain rights beyond those granted. IBM does not say whether user-defined functions are enabled by default. Others can skip it.
Who cares cockroachdb, ibm-vpc, postgresql-compatible, self-hosted
25.2.20 on the 25.2 line, older than 25.4.12 on 25.4, or older than 26.2.3 on 26.2IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.2.3 · 25.4.12 +1
Upgrade CockroachDB PostgreSQL for IBM VPC to 25.2.20, 25.4.12 or 26.2.3 (download from IBM Passport Advantage Online).