CVE-2026-11401

Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

Published Jun 5, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Analysis

Technical impact

The vulnerability is an untrusted search path flaw in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL; a creator of an executed function can elevate their privileges to any RDS user, including rds_superuser, due to CWE-426.

Affected Systems

Affected systems are instances running the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL; the product is identified as AWS Advanced Go Wrapper and no specific version ranges are listed in the CNA data, so any installation before the 2026-05-26 release may be vulnerable.

Risk and Exploitability

With a CVSS score of 8.6 the issue represents high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. A remote authenticated low‑privilege user can trigger the flaw by crafting and executing a function, indicating that the attack vector is remote authenticated; given the high impact and the likelihood of exploitation when users can create functions, the risk to system integrity is significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AWS

AWS Advanced Go Wrapper

unaffected

Version	Status	Constraints
`2026-04-06`	affected	< 2026-05-26

No data.

Vendor Product Versions

Aws

Aws Advanced Go Wrapper

Version	Status	Scheme	Platform
`[2026-04-06,2026-05-26)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the AWS Advanced Go Wrapper to release 2026-05-26
Revoke or restrict the CREATE FUNCTION privilege from low‑privilege RDS users
Verify that only trusted users or roles can add functions by reviewing IAM policies and RDS parameter groups

Generated by OpenCVE AI on June 5, 2026 at 20:37 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-r236-5pc3-3qcp	AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.305% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-039-aws/
https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26
https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp

History

Jun 8, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 7:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
Title		Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
First Time appeared		Aws Aws aws Advanced Go Wrapper
Weaknesses		CWE-426
CPEs		cpe:2.3:a:aws:aws_advanced_go_wrapper::::::::
Vendors & Products		Aws Aws aws Advanced Go Wrapper
References		https://aws.amazon.com/security/security-bulletins/2026-039-aws/ https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26 https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`