CVE-2026-11401: Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

Published Jun 5, 2026
·
Updated

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Other sources

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL.

An issue in Aurora PostgreSQL using the AWS Go Wrapper waa identified, see CVE-2026-11401.

Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

Impacted versions: AWS Go Wrapper 2026-04-06

Patches This issue has been addressed in AWS Go Wrapper 2026-05-26. Maintainers recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds Remove the public schema from the search path.

References If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

— GitHub

Affected Software

12 affected componentsFixes available
Amazon Web Services AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL<2026-05-26
go/github.com/aws/aws-advanced-go-wrapper/auth-helpers<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/otlp<=1.0.6
1.0.7
go/github.com/aws/aws-advanced-go-wrapper/pgx-driver<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/okta<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/mysql-driver<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/iam<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/federated-auth<=1.1.0
1.1.1
go/github.com/aws/aws-advanced-go-wrapper/custom-endpoint<=1.0.3
1.0.4
go/github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager<=1.1.1
1.1.2
go/github.com/aws/aws-advanced-go-wrapper/xray<=1.06
1.07
go/github.com/aws/aws-advanced-go-wrapper/awssql/v2<=2.0.0
2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/auth-helpers to a version that resolves this vulnerability.

    Fixed in 1.1.1
  2. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/otlp to a version that resolves this vulnerability.

    Fixed in 1.0.7
  3. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/pgx-driver to a version that resolves this vulnerability.

    Fixed in 1.1.1
  4. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/okta to a version that resolves this vulnerability.

    Fixed in 1.1.1
  5. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/mysql-driver to a version that resolves this vulnerability.

    Fixed in 1.1.1
  6. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/iam to a version that resolves this vulnerability.

    Fixed in 1.1.1
  7. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/federated-auth to a version that resolves this vulnerability.

    Fixed in 1.1.1
  8. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/custom-endpoint to a version that resolves this vulnerability.

    Fixed in 1.0.4
  9. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager to a version that resolves this vulnerability.

    Fixed in 1.1.2
  10. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/xray to a version that resolves this vulnerability.

    Fixed in 1.07
  11. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper/awssql/v2 to a version that resolves this vulnerability.

    Fixed in 2.0.1
  12. Upgrade

    Upgrade go/github.com/aws/aws-advanced-go-wrapper to a version that resolves this vulnerability.

    Fixed in 2026-05-26
  13. Configuration

    Remove the public schema from the search_path (i.e., ensure 'public' is not present in the database search_path) for affected Aurora PostgreSQL instances as a workaround until you upgrade to the fixed release.

    PostgreSQL search_path search_path = remove public

Event History

Jun 5, 2026
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Jun 11, 2026
Advisory Published
via GitHub·08:33 PM
Data Sourced
via GitHub·08:33 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-11401?

CVE-2026-11401 has a high severity rating of 8.

2

How do I fix CVE-2026-11401?

To fix CVE-2026-11401, update to the latest version of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL that addresses this vulnerability.

3

What are the risks associated with CVE-2026-11401?

CVE-2026-11401 allows remote authenticated low-privilege users to escalate their privileges to that of a higher-privileged Amazon RDS user.

4

What type of vulnerability is CVE-2026-11401?

CVE-2026-11401 is categorized as a privilege escalation vulnerability due to an untrusted search path in the GlobalDatabasePlugin.

5

Who is affected by CVE-2026-11401?

CVE-2026-11401 affects users of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203