GO-2026-5601: Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
Published Jun 5, 2026
·Updated
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.
To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
Affected Software
1 affected component
AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLto a version that resolves this vulnerability.Fixed in 2026-05-26
Event History
Jun 5, 2026
CVE Published
via OSV·07:07 PM
Data Sourced
via OSV·07:07 PM
DescriptionSeverityWeakness