---
id: "CVE-2026-18893"
page: "https://infrastack.ai/live/CVE-2026-18893"
kind: "vulnerability"
aliases: ["CVE-2026-18893"]
title: "IBM CockroachDB PostgreSQL for IBM VPC: user-defined functions allow privilege escalation"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "CockroachDB PostgreSQL for IBM VPC", "fixed": ["25.2.20", "25.4.12", "26.2.3"], "affected": "< 25.2.20, >= 25.4.0 < 25.4.12, >= 26.2.0 < 26.2.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cockroachdb", "ibm-vpc", "postgresql-compatible", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-08T19:17:38+00:00"
first_seen_at: "2026-11-08T19:22:33+00:00"
updated_at: "2026-11-08T19:24:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18893", "first_seen_at": "2026-11-08T19:22:33+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893", "first_seen_at": "2026-11-08T19:24:50+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893"]}]
exploit_sources: []
---

# IBM CockroachDB PostgreSQL for IBM VPC: user-defined functions allow privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-18893 (this .md is for agents)

IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 can be abused to escalate privileges through a user-defined function. An attacker with a database account could gain rights beyond what they were granted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CockroachDB PostgreSQL for IBM VPC affected < 25.2.20, >= 25.4.0 < 25.4.12, >= 26.2.0 < 26.2.3 fixed 25.2.20, 25.4.12, 26.2.3

## How to check

Check the deployed CockroachDB version (SELECT version(); or cockroach version). Exposed if it is older than 25.2.20 on the 25.2 line, older than 25.4.12 on 25.4, or older than 26.2.3 on 26.2. Also review which database accounts can create or run user-defined functions.

## Fix

Upgrade CockroachDB PostgreSQL for IBM VPC to 25.2.20, 25.4.12 or 26.2.3 (download from IBM Passport Advantage Online).

## Timeline

- 2026-11-08T19:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18893
- 2026-11-08T19:24:50+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893 — IBM bulletin (21 Oct 2026) read: all versions before 25.2.20/25.4.12/26.2.3 impacted; NVD text says 'through' those versions, bulletin and Cockroach advisory S-26100614 say before, so I used the bulletin. Workarounds: none. UDF default state not stated by IBM. No exploitation or PoC seen.

## Documents

- [advisory] IBM Security Bulletin: CockroachDB PostgreSQL for IBM VPC (CVE-2026-18546, CVE-2026-18893) https://www.ibm.com/support/pages/security-bulletin-cockroachdb-postgresql-ibm-vpc-affected-multiple-vulnerabilities-cve-2026-18546-cve-2026-18893

## From the sources

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_