CVE-2026-126793

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126793
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126793.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126793
Aliases
  • GHSA-fhr2-6r5v-gm9f
Published
2026-11-12T21:04:58Z
Modified
2026-11-14T02:47:31Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
Details

An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-426"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126793.json"
}
References

Affected packages

Git / github.com/aws/aws-advanced-go-wrapper

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-advanced-go-wrapper
Events
Introduced
5d5c15fb42af8bb6e818af635b54972571280e6e
Fixed
14514e0f8ac5b0d93d4b3d79825a10074d2bb07c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2026-04-06"
                },
                {
                    "fixed": "2026-07-29"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "release-2026-07-29",
            "range": [
                {
                    "fixed": "14514e0f8ac5b0d93d4b3d79825a10074d2bb07c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126793.json"