CVE-2026-11400: CWE-426: Untrusted Search Path in AWS AWS Advanced JDBC Wrapper

The vulnerability identified as CVE-2026-11400 involves an untrusted search path in the GlobalDatabasePlugin component of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL. A remote authenticated user with low privileges can exploit this by creating a malicious function that runs when another user connects to the database cluster via the vulnerable wrapper. This results in privilege escalation to the permissions of the targeted Amazon RDS user, including the rds_superuser role. The vulnerability affects versions >=3.0.0 and <4.0.1. AWS has published an official advisory and released version 4.0.1 of the wrapper to fix this issue.

Successful exploitation allows a remote authenticated low-privilege user to escalate privileges to those of another Amazon RDS user, including the rds_superuser role, which has extensive administrative capabilities. This can lead to full control over the affected database cluster, compromising confidentiality, integrity, and availability of data and services.

AWS has released version 4.0.1 of the AWS Advanced JDBC Wrapper to address this vulnerability. Users should upgrade to version 4.0.1 or later to remediate the issue. Since this is a cloud-hosted service component, AWS manages remediation for the service, but customers must update their client-side wrapper versions accordingly. Check the AWS security advisory at https://aws.amazon.com/security/security-bulletins/2026-039-aws/ for the latest guidance.