Privilege Escalation in IBM CockroachDB PostgreSQL Affected by User-Defined Function

CVE-2026-18893

What is CVE-2026-18893?

IBM CockroachDB PostgreSQL versions 26.2.0 to 26.2.3, 25.4.0 to 25.4.12, and 25.2.0 to 25.2.20 contain a vulnerability that allows an attacker to escalate their privileges through the use of user-defined functions. This could potentially enable unauthorized access to sensitive database operations and data manipulation. It is crucial for users of the affected versions to apply the necessary patches as provided by IBM to mitigate this security risk. For further details, refer to the vendor advisory.

References