CVE-2026-11401: CWE-426: Untrusted Search Path in AWS AWS Advanced Go Wrapper
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-11401 involves an untrusted search path in the GlobalDatabasePlugin component of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. Exploitation requires a remote authenticated user with low privileges to create a specially crafted function. When another user connects to the cluster via the vulnerable wrapper, this function executes, enabling privilege escalation to another Amazon RDS user’s privileges, including rds_superuser. AWS has provided a remediation by releasing an updated wrapper version on 2026-05-26. The vulnerability has a CVSS v3.1 score of 8.0, indicating high severity.
Potential Impact
Successful exploitation results in privilege escalation from a low-privilege authenticated user to a higher-privilege Amazon RDS user, including the rds_superuser role. This can lead to full control over the affected Amazon Aurora PostgreSQL cluster, compromising confidentiality, integrity, and availability of the database environment.
Mitigation Recommendations
AWS manages remediation for this cloud-hosted service. Users should upgrade to the AWS Advanced Go Wrapper release dated 2026-05-26 or later, as this version contains the fix for the untrusted search path vulnerability. Check the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-039-aws/ for the latest remediation guidance.
CVE-2026-11401: CWE-426: Untrusted Search Path in AWS AWS Advanced Go Wrapper
Description
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
CVSS v3.1
Score 8.0high
Affected software
pkg:golang/github.com/aws/aws-advanced-go-wrapperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-11401 involves an untrusted search path in the GlobalDatabasePlugin component of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. Exploitation requires a remote authenticated user with low privileges to create a specially crafted function. When another user connects to the cluster via the vulnerable wrapper, this function executes, enabling privilege escalation to another Amazon RDS user’s privileges, including rds_superuser. AWS has provided a remediation by releasing an updated wrapper version on 2026-05-26. The vulnerability has a CVSS v3.1 score of 8.0, indicating high severity.
Potential Impact
Successful exploitation results in privilege escalation from a low-privilege authenticated user to a higher-privilege Amazon RDS user, including the rds_superuser role. This can lead to full control over the affected Amazon Aurora PostgreSQL cluster, compromising confidentiality, integrity, and availability of the database environment.
Mitigation Recommendations
AWS manages remediation for this cloud-hosted service. Users should upgrade to the AWS Advanced Go Wrapper release dated 2026-05-26 or later, as this version contains the fix for the untrusted search path vulnerability. Check the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-039-aws/ for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-06-05T16:33:50.490Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-039-aws/","vendor":"AWS"}]
Threat ID: 6a232492e29bf47b50b16f51
Added to database: 06/05/2026, 19:33:38 UTC
Last enriched: 06/13/2026, 09:45:41 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.