Privilege Escalation in Aurora PostgreSQL using AWS JDBC Wrapper, AWS Go Wrapper, AWS NodeJS Wrapper, AWS Python Wrapper, AWS PGSQL ODBC driver
Bulletin ID: AWS-2025-028 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/11/10 10:15 AM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2025-12967, an issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS JDBC Wrapper <2.6.5 - AWS Go Wrapper <2025-10-17 - AWS NodeJS Wrapper <2.0.1 - AWS Python Wrapper <1.4.0 - AWS ODBC driver <1.0.1
AI Analysis
Technical Summary
Amazon Aurora PostgreSQL, a managed relational database compatible with PostgreSQL, has a privilege escalation vulnerability identified as CVE-2025-12967 in its AWS Wrappers (JDBC, Go, NodeJS, Python, PGSQL ODBC driver). The flaw allows a low privilege authenticated user to create a specially crafted function that can execute with the permissions of other RDS users, including the rds_superuser role. Impacted versions are AWS JDBC Wrapper versions before 2.6.5, AWS Go Wrapper before 2025-10-17, AWS NodeJS Wrapper before 2.0.1, AWS Python Wrapper before 1.4.0, and AWS PGSQL ODBC driver before 1.0.1. AWS has released fixed versions for all affected wrappers and recommends upgrading to these versions. As a workaround, removing the public schema from the search path can mitigate the issue.
Potential Impact
A low privilege authenticated user can escalate privileges to the rds_superuser role by exploiting this vulnerability, potentially gaining elevated permissions within Amazon Aurora PostgreSQL environments. This can lead to unauthorized actions with high-level database privileges.
Mitigation Recommendations
AWS has released official fixes for this vulnerability. Users should upgrade to the following versions or later: AWS JDBC Wrapper v2.6.5, AWS Go Wrapper 2025-10-17, AWS NodeJS Wrapper v2.0.1, AWS Python Wrapper v1.4.0, and AWS PGSQL ODBC driver v1.0.1. As a temporary workaround, removing the public schema from the search path can reduce exposure. Patch status is confirmed fixed by AWS.
Privilege Escalation in Aurora PostgreSQL using AWS JDBC Wrapper, AWS Go Wrapper, AWS NodeJS Wrapper, AWS Python Wrapper, AWS PGSQL ODBC driver
Description
Bulletin ID: AWS-2025-028 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/11/10 10:15 AM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2025-12967, an issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS JDBC Wrapper <2.6.5 - AWS Go Wrapper <2025-10-17 - AWS NodeJS Wrapper <2.0.1 - AWS Python Wrapper <1.4.0 - AWS ODBC driver <1.0.1
Affected software
pkg:maven/com.amazonaws/aws-jdbc-wrapperpkg:golang/github.com/aws/aws-go-wrapperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Amazon Aurora PostgreSQL, a managed relational database compatible with PostgreSQL, has a privilege escalation vulnerability identified as CVE-2025-12967 in its AWS Wrappers (JDBC, Go, NodeJS, Python, PGSQL ODBC driver). The flaw allows a low privilege authenticated user to create a specially crafted function that can execute with the permissions of other RDS users, including the rds_superuser role. Impacted versions are AWS JDBC Wrapper versions before 2.6.5, AWS Go Wrapper before 2025-10-17, AWS NodeJS Wrapper before 2.0.1, AWS Python Wrapper before 1.4.0, and AWS PGSQL ODBC driver before 1.0.1. AWS has released fixed versions for all affected wrappers and recommends upgrading to these versions. As a workaround, removing the public schema from the search path can mitigate the issue.
Potential Impact
A low privilege authenticated user can escalate privileges to the rds_superuser role by exploiting this vulnerability, potentially gaining elevated permissions within Amazon Aurora PostgreSQL environments. This can lead to unauthorized actions with high-level database privileges.
Mitigation Recommendations
AWS has released official fixes for this vulnerability. Users should upgrade to the following versions or later: AWS JDBC Wrapper v2.6.5, AWS Go Wrapper 2025-10-17, AWS NodeJS Wrapper v2.0.1, AWS Python Wrapper v1.4.0, and AWS PGSQL ODBC driver v1.0.1. As a temporary workaround, removing the public schema from the search path can reduce exposure. Patch status is confirmed fixed by AWS.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/aws-2025-028/","fetched":true,"fetchedAt":"2026-05-26T20:30:26.791Z","wordCount":187}
Threat ID: 6a1602f0e29bf47b505da204
Added to database: 05/26/2026, 20:30:40 UTC
Last enriched: 06/05/2026, 19:31:25 UTC
Last updated: 07/31/2026, 19:22:53 UTC
Views: 133
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.