CVE-2026-11401 high CVSS 8.0

Vulnerability in github.com/aws/aws-advanced-go-wrapper/awssql/v2 (CVE-2026-11401)

Summary

Vulnerability in github.com/aws/aws-advanced-go-wrapper/awssql/v2 (CVE-2026-11401). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 2.0.1 or later.

Original description

The description as published by the source.

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLにあるGlobalDatabasePluginの信頼されていない検索パスの問題により、リモートの認証された低権限のユーザーが、別のAmazon RDSユーザーの権限をエスカレーションすることが可能です。これにはrds_superuserも含まれます。

❓ What is the problem

AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLにおける信頼されていない検索パスの問題。

📍 Affected scope

Amazon Aurora PostgreSQLのAWS Advanced Go WrapperのGlobalDatabasePlugin。

🔥 Severity

信頼されていないパスを利用してAmazon RDSユーザーの権限を不正にエスカレーションできる。

🔧 How to fix

AWS Advanced Go Wrapperの2026-05-26リリースにアップグレード。

🛡️ Workaround

情報なし

🔍 Detection

影響を受けるバージョンのAWS Advanced Go Wrapperを使用しているかを確認。

Affected packages

go github.com/aws/aws-advanced-go-wrapper/awssql/v2

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]

go github.com/aws/aws-advanced-go-wrapper/xray

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.07"}]}]

go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]

go github.com/aws/aws-advanced-go-wrapper/custom-endpoint

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]

go github.com/aws/aws-advanced-go-wrapper/federated-auth