Server-Side Request Forgery in CockroachDB by IBM
CVE-2026-18546

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Cockroachdb Postgresql For IBM Vpc
Vendor
CVE Published:
8 November 2026

What is CVE-2026-18546?

An implementation flaw in IBM's CockroachDB, spanning multiple versions, allows an authenticated user to exploit the server-side request forgery vulnerability. This flaw enables potential attackers to issue unauthorized requests from within the system, which can lead to significant risks such as network enumeration and further exploitation. Organizations using affected versions must assess their vulnerability and implement necessary patches to safeguard their systems against these threats.

Affected Version(s)

CockroachDB PostgreSQL for IBM VPC 26.2.0 <= 26.2.3

CockroachDB PostgreSQL for IBM VPC 25.4.0 <= 25.4.12

CockroachDB PostgreSQL for IBM VPC 25.2.0 <= 25.2.20

References

https://www.ibm.com/support/pages/node/7293292
vendor-advisorypatch

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.