CVE-2026-18546
Last modified
CVE-2026-18546 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks..
Description
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| IBM | CockroachDB PostgreSQL for IBM VPC | >= 26.2.0, <= 26.2.3; >= 25.4.0, <= 25.4.12; >= 25.2.0, <= 25.2.20 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-18546?
How severe is CVE-2026-18546?
How do I fix CVE-2026-18546?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18537IBM Maximo Application Suite - Location Service for Esri Com…8.7
- CVE-2026-1854The Post Flagger plugin for WordPress is vulnerable to Store…6.4
- CVE-2026-18540undici's retry interceptor can append the body of a ranged r…3.7
- CVE-2026-18541IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored …5.4
- CVE-2026-18544IBM Portieris 0.5.0 through 0.14.2 could allow a remote auth…8.1
- CVE-2026-18545IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to serve…4.3
- CVE-2026-18547The Ultimate Member – User Profile, Registration, Login, Mem…6.4
- CVE-2026-18548The Groundhogg — CRM, Newsletters, and Marketing Automation …7.2
- CVE-2026-18549@fastify/multipart is a multipart form-data parser for Fasti…7.5
- CVE-2026-18550The Nokri - Job Board WordPress Theme for WordPress is vulne…9.8
- CVE-2026-18551Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11…6.5
- CVE-2026-18554IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …7.5
Are you affected by CVE-2026-18546?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST