CVE-2026-126793: Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rdssuperuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.
To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Advanced Go Wrapper (awssql)to a version that resolves this vulnerability.Fixed in v2.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Aurora PostgreSQL deployments are exposed if they use AWS Advanced Go Wrapper versions from awssql/v2.0.0 through versions before awssql/v2.0.3, and an authenticated database user can create a crafted function that is resolved through the search path.
What does an attacker need to exploit it?
The attacker needs remote authenticated access to the Aurora PostgreSQL cluster and must be able to provide a crafted function. Exploitation occurs when another database user connects through an affected wrapper version.
Are all database users at equal risk?
No. The impact depends on which user connects through the affected wrapper: the attacker may gain that user's privileges. This can include privileges of a user holding the rds_superuser role.
How should this be remediated?
Upgrade the AWS Advanced Go Wrapper to the 2026-07-29 release, awssql/v2.0.3, or later.