CVE-2026-11400 and CVE-2026-11401
Bulletin ID: 2026-039-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/025/2026 12:15 PM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2026-11400(JDBC) and CVE-2026-11401(Go), an issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS Advanced JDBC Wrapper >=3.0.0 and < 4.0.1 - AWS Advanced Go Wrapper release 2026-04-06 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
CVE-2026-11400 and CVE-2026-11401 are privilege escalation vulnerabilities in AWS Wrappers for Amazon Aurora PostgreSQL. They allow an authenticated user with low privileges to create a specially crafted function that executes with the permissions of other Amazon RDS users, including escalation to the rds_superuser role. The affected components are the AWS Advanced JDBC Wrapper versions >=3.0.0 and <4.0.1, and the AWS Advanced Go Wrapper release 2026-04-06. AWS has addressed these issues in the JDBC Wrapper version 4.0.1 and Go Wrapper release 2026-05-26. The vendor recommends upgrading to these fixed versions and patching any forked or derivative code. As a workaround, removing the public schema from the search path can mitigate the issue.
Potential Impact
An attacker with low privilege authenticated access to the affected AWS Wrappers can escalate their privileges to the rds_superuser role, gaining elevated permissions within Amazon Aurora PostgreSQL. This could allow unauthorized actions that require higher privileges, potentially compromising database integrity and confidentiality.
Mitigation Recommendations
AWS has released fixed versions that address these vulnerabilities: AWS Advanced JDBC Wrapper version 4.0.1 and AWS Advanced Go Wrapper release 2026-05-26. It is recommended to upgrade to these versions promptly. Additionally, any forked or derivative code should be patched to incorporate these fixes. As a temporary workaround, removing the public schema from the search path can reduce risk until upgrades are applied.
CVE-2026-11400 and CVE-2026-11401
Description
Bulletin ID: 2026-039-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/025/2026 12:15 PM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2026-11400(JDBC) and CVE-2026-11401(Go), an issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS Advanced JDBC Wrapper >=3.0.0 and < 4.0.1 - AWS Advanced Go Wrapper release 2026-04-06 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected software
pkg:maven/com.amazonaws/aws-advanced-jdbc-wrapperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11400 and CVE-2026-11401 are privilege escalation vulnerabilities in AWS Wrappers for Amazon Aurora PostgreSQL. They allow an authenticated user with low privileges to create a specially crafted function that executes with the permissions of other Amazon RDS users, including escalation to the rds_superuser role. The affected components are the AWS Advanced JDBC Wrapper versions >=3.0.0 and <4.0.1, and the AWS Advanced Go Wrapper release 2026-04-06. AWS has addressed these issues in the JDBC Wrapper version 4.0.1 and Go Wrapper release 2026-05-26. The vendor recommends upgrading to these fixed versions and patching any forked or derivative code. As a workaround, removing the public schema from the search path can mitigate the issue.
Potential Impact
An attacker with low privilege authenticated access to the affected AWS Wrappers can escalate their privileges to the rds_superuser role, gaining elevated permissions within Amazon Aurora PostgreSQL. This could allow unauthorized actions that require higher privileges, potentially compromising database integrity and confidentiality.
Mitigation Recommendations
AWS has released fixed versions that address these vulnerabilities: AWS Advanced JDBC Wrapper version 4.0.1 and AWS Advanced Go Wrapper release 2026-05-26. It is recommended to upgrade to these versions promptly. Additionally, any forked or derivative code should be patched to incorporate these fixes. As a temporary workaround, removing the public schema from the search path can reduce risk until upgrades are applied.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-039-aws/","fetched":true,"fetchedAt":"2026-06-05T19:26:27.164Z","wordCount":189}
- Classification
- {"confidence":0.93,"severitySource":"heuristic","classifier":"rss-v2"}
Threat ID: 6a2322ede29bf47b50b0be88
Added to database: 06/05/2026, 19:26:37 UTC
Last enriched: 06/13/2026, 08:43:25 UTC
Last updated: 09/14/2026, 22:01:31 UTC
Views: 218
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.