Vulnerability in software.amazon.jdbc:aws-advanced-jdbc-wrapper (CVE-2026-11400)
Summary
Vulnerability in software.amazon.jdbc:aws-advanced-jdbc-wrapper (CVE-2026-11400). Successful exploitation can lead to full system takeover. Exploitable via CacheResultSet. Mitigation: upgrade to 4.0.1 or later.
Original description
The description as published by the source.
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL.
The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper
Impact
An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
Impacted versions: AWS Advanced JDBC Wrapper >= 3.0.0 and < 4.0.1
Patches
This issue has been addressed in AWS JDBC Wrapper v4.0.1. It is recommended to upgrade to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Remove the public schema from the search path.
Resources
If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
AWS-JDBC Wrapper would like to thank x.com/ph0smet for collaborating on this issue through the coordinated vulnerability disclosure process.
Source: AWS Security Bulletins NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
CVE-2026-11400は、AWSのAmazon Aurora PostgreSQLに関する特権昇格の脆弱性です。AWS Wrappersを利用することで、低権限の認証ユーザーが他のユーザーの権限でコードを実行できるリスクがあります。この脆弱性は、特定のバージョンのAWS Advanced JDBC WrapperとAWS Advanced Go Wrapperに影響を与えます。
AWS Wrappers for Amazon Aurora PostgreSQLにおける特権昇格の脆弱性
AWS Advanced JDBC Wrapper >=3.0.0と<4.0.1、およびAWS Advanced Go Wrapper 2026-04-06リリース
低権限の認証ユーザーが、他のRDSユーザーの権限でコードを実行できるため、非常に深刻
AWS Advanced JDBC Wrapperをバージョン4.0.1以上にアップデート
情報なし
影響のあるバージョンを使用しているか確認する
Affected packages
References
- advisory nvd.nist.gov
- AWS aws.amazon.com
- package github.com
- web aws.amazon.com
- web github.com
- web cve.org
- web github.com
- web aws.amazon.com
- web github.com