CVE-2026-11400: Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.
To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.
Other sources
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL.
The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper
Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
Impacted versions: AWS Advanced JDBC Wrapper >= 3.0.0 and < 4.0.1
Patches This issue has been addressed in AWS JDBC Wrapper v4.0.1. It is recommended to upgrade to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds Remove the public schema from the search path.
Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
AWS-JDBC Wrapper would like to thank x.com/ph0smet for collaborating on this issue through the coordinated vulnerability disclosure process.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/software.amazon.jdbc:aws-advanced-jdbc-wrapperto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQLto a version that resolves this vulnerability.Fixed in 4.0.1 - Configuration
In the GlobalDatabasePlugin, remove the public schema from the search path so the crafted function cannot execute with higher privileges.
GlobalDatabasePlugin (AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL) search_path (remove public schema) = Remove the public schema from the search path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11400?
CVE-2026-11400 has a severity rating of high, with a score of 8.
How does CVE-2026-11400 affect AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL?
CVE-2026-11400 allows a remote low-privilege authenticated user to escalate privileges to those of a higher-level Amazon RDS user.
Who is vulnerable to CVE-2026-11400?
Organizations using AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL are vulnerable if they allow low-privilege users access.
How do I fix CVE-2026-11400?
To fix CVE-2026-11400, update to the latest version of AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL as recommended by AWS.
What type of attack does CVE-2026-11400 facilitate?
CVE-2026-11400 facilitates privilege escalation attacks, allowing attackers to gain higher privileges within Amazon RDS.