{"id":"CVE-2026-18893","kind":"vulnerability","aliases":["CVE-2026-18893"],"related":[],"title":"IBM CockroachDB PostgreSQL for IBM VPC: user-defined functions allow privilege escalation","description":"IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.","summary":"IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 can be abused to escalate privileges through a user-defined function. An attacker with a database account could gain rights beyond what they were granted.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CockroachDB PostgreSQL for IBM VPC","fixed":["25.2.20","25.4.12","26.2.3"],"affected":"< 25.2.20, >= 25.4.0 < 25.4.12, >= 26.2.0 < 26.2.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["cockroachdb","ibm-vpc","postgresql-compatible","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check the deployed CockroachDB version (SELECT version(); or cockroach version). Exposed if it is older than 25.2.20 on the 25.2 line, older than 25.4.12 on 25.4, or older than 26.2.3 on 26.2. Also review which database accounts can create or run user-defined functions.","fix":"Upgrade CockroachDB PostgreSQL for IBM VPC to 25.2.20, 25.4.12 or 26.2.3 (download from IBM Passport Advantage Online).","status":"open","published_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","triaged_at":"2026-11-08T19:23:11+00:00","updated_at":"2026-11-08T19:24:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T19:23:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM CockroachDB PostgreSQL for IBM VPC: user-defined functions allow privilege escalation","impact":"high","summary":"IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 can be abused to escalate privileges through a user-defined function. An attacker with a database account could gain rights beyond what they were granted.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["cockroachdb","ibm-vpc","postgresql-compatible"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged database user gains elevated database privileges","analyst_note":"Confirm the fixed versions and whether user-defined functions are enabled by default, using the IBM security bulletin for CVE-2026-18893.","how_to_check":"- Check the deployed version of IBM CockroachDB PostgreSQL for IBM VPC against the affected ranges: 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20.\n- Review which accounts can create or run user-defined functions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4575,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and whether user-defined functions are enabled by default, using the IBM security bulletin for CVE-2026-18893.","search":"'-18893':16A,19A '-2026':15A,18A '25.2.0':50B,92C '25.2.20':52B,94C '25.4.0':46B,88C '25.4.12':48B,90C '26.2.0':43B,85C '26.2.3':45B,87C 'abus':55B 'account':70B 'allow':11A 'attack':66B 'beyond':74B 'cockroachdb':2A,20A,25B,37B,80C 'compat':31B 'could':71B 'cve':14A,17A 'databas':69B 'defin':9A,63B,103C 'escal':13A,57B,99C 'for':22A 'function':10A,64B,104C 'gain':72B 'grant':78B 'host':34B 'ibm':1A,5A,23A,27B,36B,40B,79C,83C 'ibm-vpc':26B 'postgresql':3A,21A,30B,38B,81C 'postgresql-compat':29B 'privileg':12A,58B,98C 'right':73B 'self':33B 'self-host':32B 'user':8A,62B,102C 'user-defin':7A,61B,101C 'vendor':35B 'version':42B 'via':100C 'vpc':6A,24A,28B,41B,84C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Teams running CockroachDB PostgreSQL for IBM VPC on versions before 25.2.20, 25.4.12 or 26.2.3. An attacker needs a database account (local, low privilege) and can use a user-defined function to gain rights beyond those granted. IBM does not say whether user-defined functions are enabled by default. Others can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218},"products":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218},"mitigations":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218},"workarounds":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218},"how_to_check":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218},"who_affected":{"at":"2026-11-08T19:24:50Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","run_id":2218}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cockroachdbpostgresqlforibmvpc","postgresqlforibmvpc"],"ptokens":["cockroachdb","for","ibm","postgresql","vpc"],"labels":["cockroachdb","high","ibmvpc","postgresqlcompatible","selfhosted","vendor"],"campaign_type":null,"search_a":"'-18893':16A,19A '-2026':15A,18A 'allow':11A 'cockroachdb':2A,20A 'cve':14A,17A 'defin':9A 'escal':13A 'for':22A 'function':10A 'ibm':1A,5A,23A 'postgresql':3A,21A 'privileg':12A 'user':8A 'user-defin':7A 'vpc':6A,24A","search_b":"'25.2.0':50B '25.2.20':52B '25.4.0':46B '25.4.12':48B '26.2.0':43B '26.2.3':45B 'abus':55B 'account':70B 'attack':66B 'beyond':74B 'cockroachdb':25B,37B 'compat':31B 'could':71B 'databas':69B 'defin':63B 'escal':57B 'function':64B 'gain':72B 'grant':78B 'host':34B 'ibm':27B,36B,40B 'ibm-vpc':26B 'postgresql':30B,38B 'postgresql-compat':29B 'privileg':58B 'right':73B 'self':33B 'self-host':32B 'user':62B 'user-defin':61B 'vendor':35B 'version':42B 'vpc':28B,41B","search_c":"'25.2.0':92C '25.2.20':94C '25.4.0':88C '25.4.12':90C '26.2.0':85C '26.2.3':87C 'cockroachdb':80C 'defin':103C 'escal':99C 'function':104C 'ibm':79C,83C 'postgresql':81C 'privileg':98C 'user':102C 'user-defin':101C 'via':100C 'vpc':84C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18893","severity":null,"published_at":"2026-11-08T19:17:38+00:00","modified_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","fetched_at":"2026-11-08T19:22:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18893:2218","url":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","severity":null,"published_at":"2026-11-08T19:24:50+00:00","modified_at":"2026-11-08T19:24:50+00:00","first_seen_at":"2026-11-08T19:24:50+00:00","fetched_at":"2026-11-08T19:24:50+00:00","note":"IBM bulletin (21 Oct 2026) read: all versions before 25.2.20/25.4.12/26.2.3 impacted; NVD text says 'through' those versions, bulletin and Cockroach advisory S-26100614 say before, so I used the bulletin. Workarounds: none. UDF default state not stated by IBM. No exploitation or PoC seen.","cites":["https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893"]}],"documents":[{"id":103201,"url":"https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893","title":"IBM Security Bulletin: CockroachDB PostgreSQL for IBM VPC (CVE-2026-18546, CVE-2026-18893)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}