AWS Adv Go Wrapper GDBP Untrusted Search Path Escalation
CVE-2026-11401 Published on June 5, 2026

Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-11401 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an Untrusted Path Vulnerability?

The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.

CVE-2026-11401 has been classified to as an Untrusted Path vulnerability or weakness.


Products Associated with CVE-2026-11401

stack.watch emails you whenever new vulnerabilities are published in Aws Advanced Go Wrapper or Amazon Aws. Just hit a watch button to start following.

Aws Advanced Go Wrapper
 
Amazon Aws
 

Affected Versions

AWS Advanced Go Wrapper: