Skip to main content
Publication date: October 6, 2026

​
Description

Two security vulnerabilities were identified in CockroachDB, including privilege escalation and server-side request forgery (SSRF). These vulnerabilities could allow authenticated users to gain elevated privileges beyond those assigned to their account, and access unauthorized data.

​
Privilege escalation via user-defined function

A privilege escalation vulnerability exists in the execution of custom database routines. An authenticated SQL user could exploit this to execute SQL statements with elevated privileges, resulting in unauthorized read and write access to data in the cluster. Severity: CVSS 3.1 Base Score: 8.8 (High) — AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

​
Server-side request forgery and local file read

An authenticated SQL user with the ability to create or select tables could exploit a Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability to read arbitrary local files on the database node or make unauthorized network requests. This impacts the confidentiality of local system files and internal network resources. Severity: CVSS 3.1 Base Score: 7.8 (High) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

​
Versions affected

All CockroachDB versions before v26.2.3, v26.1.6, v25.4.12, v25.2.20, v24.3.34, v24.1.31, v23.2.31 are impacted.

​
Fixed in

All vulnerabilities described above have been resolved. The fixes have been applied to all supported releases of CockroachDB: v26.2.3, v26.1.6, v25.4.12, v25.2.20, v24.3.34, v24.1.31, v23.2.31, published on July 1, 2026.

​
Mitigation

Users of CockroachDB v21.2 and later should upgrade to v26.2.3, v26.1.6, v25.4.12, v25.2.20, v24.3.34, v24.1.31, v23.2.31, or a later version.

​
Additional Assistance

If more information or assistance is needed, contact the Cockroach Labs support team.