Threats affecting pkg:maven/com.ibm/cockroachdb-postgresql-for-ibm-vpc

IBM CockroachDB PostgreSQL for IBM VPC versions 25.2.0 through 25.2.20, 25.4.0 through 25.4.12, and 26.2.0 through 26.2.3 contain a vulnerability that allows privilege escalation via user-defined functions. This improper privilege management issue is identified as CWE-269 and has a CVSS v3.1 score of 7.1, indicating high severity.

IBM CockroachDB PostgreSQL for IBM VPC versions 25.2.0 through 25.2.20, 25.4.0 through 25.4.12, and 26.2.0 through 26.2.3 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to send unauthorized requests from the affected system, which could lead to network enumeration or assist in other attacks. The vulnerability has a medium severity rating with a CVSS score of 5.4.