Medium · 5.4 CVE-2026-18546 EUVD-2026-119704GHSA-3hr9-mmwr-hp4x

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Published Nov 8, 2026 · Updated Nov 12, 2026 · Assigned by ibm

Vendor: IBM Product: CockroachDB PostgreSQL for IBM VPC

Description

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Affected products

Vendor	Product	Affected	Fixed
IBM	CockroachDB PostgreSQL for IBM VPC	26.2.0 – ≤ 26.2.3, 25.4.0 – ≤ 25.4.12, 25.2.0 – ≤ 25.2.20	—

References

https://www.ibm.com/support/pages/node/7293292 vendor-advisory patch