CVE-2026-11400

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11400
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11400.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11400
Published
2026-06-05T19:07:02.459Z
Modified
2026-07-08T07:32:22.633932425Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
Details

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.

To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11400.json",
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-426"
    ]
}
References

Affected packages

Git / github.com/aws/aws-advanced-jdbc-wrapper

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-advanced-jdbc-wrapper
Events
Introduced
fb867c258d1c9dafe169095be3e98168a15ee905
Fixed
ce7e8c7b53cfd7e210abc6e6d73b248f488fcdcc
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "4.0.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11400.json"