AWS Advanced JDBC Wrapper 4.0.0 GlobalDatabasePlugin Search Path Escalation
CVE-2026-11400 Published on June 5, 2026

Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper. To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-11400 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an Untrusted Path Vulnerability?

The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.

CVE-2026-11400 has been classified to as an Untrusted Path vulnerability or weakness.


Products Associated with CVE-2026-11400

stack.watch emails you whenever new vulnerabilities are published in Aws Advanced Jdbc Wrapper or Amazon Aws. Just hit a watch button to start following.

Aws Advanced Jdbc Wrapper
 
Amazon Aws
 

Affected Versions

AWS Advanced JDBC Wrapper: