CVE-2026-11401 high CVSS 8.0

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

Database / Storage

Summary

Original description

The description as published by the source.

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL.

An issue in Aurora PostgreSQL using the AWS Go Wrapper waa identified, see CVE-2026-11401.

Impact
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

Impacted versions: AWS Go Wrapper 2026-04-06

Patches
This issue has been addressed in AWS Go Wrapper 2026-05-26. Maintainers recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds
Remove the public schema from the search path.

References
If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLにあるGlobalDatabasePluginの信頼されていない検索パスの問題により、リモートの認証された低権限のユーザーが、別のAmazon RDSユーザーの権限をエスカレーションすることが可能です。これにはrds_superuserも含まれます。

❓ What is the problem

AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLにおける信頼されていない検索パスの問題。

📍 Affected scope

Amazon Aurora PostgreSQLのAWS Advanced Go WrapperのGlobalDatabasePlugin。

🔥 Severity

信頼されていないパスを利用してAmazon RDSユーザーの権限を不正にエスカレーションできる。

🔧 How to fix

AWS Advanced Go Wrapperの2026-05-26リリースにアップグレード。

🛡️ Workaround

情報なし

🔍 Detection

影響を受けるバージョンのAWS Advanced Go Wrapperを使用しているかを確認。

Affected packages

go github.com/aws/aws-advanced-go-wrapper/awssql/v2

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]

go github.com/aws/aws-advanced-go-wrapper/xray

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.07"}]}]

go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]

go github.com/aws/aws-advanced-go-wrapper/custom-endpoint

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]

go github.com/aws/aws-advanced-go-wrapper/federated-auth