An untrusted search path flaw in the GlobalDatabasePlugin of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL enables a remote authenticated low‑privilege user to create a crafted function that executes when a higher‑privileged user connects. This allows the attacker to elevate privileges to another Amazon RDS user, including rds_superuser. The weakness aligns with CWE‑426, representing a command injection or unrestricted path traversal scenario that compromises integrity and confidentiality across database accounts.

AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL, specifically versions prior to 4.0.1 are impacted. The vulnerability exists in the wrapper’s handling of the GlobalDatabasePlugin and is addressed in release 4.0.1.

The CVSS score of 8.6 indicates high severity, and while no EPSS value is provided, the lack of a KEV listing suggests no widespread exploitation has been observed to date. The likely attack vector is a remote authenticated connection to the wrapper, enabling the attacker to submit a crafted function. Once the target user connects, the function runs with the target’s privileges, fully realizing the escalation. The exploit requires the attacker to have a low‑privilege account within the same database cluster, making it a targeted insider or credential‑stealing threat.