CVE-2026-11401

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-11401

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11401.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-11401

Aliases

Published

2026-06-05T19:07:56.341Z

Modified

2026-07-08T08:06:54.285636496Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

Details

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11401.json",
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-426"
    ]
}

References

Affected packages

Git / github.com/aws/aws-advanced-go-wrapper

Affected ranges

Type

GIT

Repo

https://github.com/aws/aws-advanced-go-wrapper

Events

Introduced

Fixed

82f2d71a4b378ffd6fbe1b5ab4ce1b774a5e5137

Database specific

{
    "extracted_events": [
        {
            "introduced": "2026-04-06"
        },
        {
            "fixed": "2026-05-26"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11401.json"