High severity · published Jun 5, 2026
CVE-2026-11401
Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.
To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AWS Advanced Go Wrapper · AWS
2026-04-06 before 2026-05-26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11401
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-039-aws/
github.com
https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26
github.com
https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp