7.1
High
CVE-2026-18893 CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
Description
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CockroachDB PostgreSQL for IBM VPC 26.2 | 26.2.0 → 26.2.3 | No fix stated |
| CockroachDB PostgreSQL for IBM VPC 25.4 | 25.4.0 → 25.4.12 | No fix stated |
| CockroachDB PostgreSQL for IBM VPC 25.2 | 25.2.0 → 25.2.20 | No fix stated |