WhatBrokeToday
FAQ
Today's Trends
highInvestigatingCockroachDBv26.2.0-26.2.3, 25.4.0-25.4.12, 25.2.0-25.2.20

IBM CockroachDB PostgreSQL for IBM VPC Privilege Escalation Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 are vulnerable to privilege escalation via user-defined functions.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Privilege escalation vulnerability via user-defined function.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    IBM CockroachDB PostgreSQL for IBM VPC 26.2.0: CVE-2026-18893 (High)(opens security advisory in a new tab)

    High severity. IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    IBM CockroachDB PostgreSQL for IBM VPC 26.2.0: CVE-2026-18893 (High)

    Source