This vulnerability (CVE-2026-11401) is classified as CWE-426 (Untrusted Search Path) and affects the AWS Advanced Go Wrapper component used with Amazon Aurora PostgreSQL. The flaw allows a remote authenticated user with low privileges to escalate their privileges to those of another RDS user, including highly privileged roles such as rds_superuser. The attack vector involves creating a malicious function that executes upon connection of the targeted user through the vulnerable wrapper. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity, with network attack vector, low attack complexity, and requiring user interaction. AWS manages this as a cloud service and has provided a patched release (2026-05-26) to remediate the issue.

Successful exploitation enables a remote authenticated low-privilege user to escalate privileges to those of another Amazon RDS user, including the rds_superuser role. This can lead to full administrative control over the affected database cluster, compromising confidentiality, integrity, and availability of the database environment.

AWS has released an updated version of the AWS Advanced Go Wrapper dated 2026-05-26 that addresses this vulnerability. Users should upgrade to this fixed release to remediate the issue. Since this is a cloud-hosted service, AWS manages the remediation process for the service environment. Refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-039-aws/ for detailed guidance and confirmation of patch status.