high
advisory
IBM CockroachDB PostgreSQL for IBM VPC: Privilege escalation via user-defined function (CVE-2026-18893)
IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 are vulnerable to privilege escalation via user-defined function.
CVE search metadata
CVE search record: CVE-2026-18893. Severity: high. CVSS: 7.1. KEV: no. Product: CockroachDB PostgreSQL for IBM VPC (26.2.0-26.2.3, 25.4.0-25.4.12, 25.2.0-25.2.20). Brief: IBM CockroachDB PostgreSQL for IBM VPC: Privilege escalation via user-defined function (CVE-2026-18893). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-18893/
Triage facts
Revision 1- Applicability
- CockroachDB PostgreSQL for IBM VPC (26.2.0-26.2.3, 25.4.0-25.4.12, 25.2.0-25.2.20)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 21:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM CockroachDB PostgreSQL for IBM VPC is affected by a privilege escalation vulnerability (CVE-2026-18893) involving user-defined functions. The base CVSS v3.1 score for this vulnerability is 7.1.