5.4
Medium
CVE-2026-18546 CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
Description
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CockroachDB PostgreSQL for IBM VPC 26.2 | 26.2.0 → 26.2.3 | No fix stated |
| CockroachDB PostgreSQL for IBM VPC 25.4 | 25.4.0 → 25.4.12 | No fix stated |
| CockroachDB PostgreSQL for IBM VPC 25.2 | 25.2.0 → 25.2.20 | No fix stated |