CVE-2026-11401

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11401
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11401.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-11401
Aliases
Downstream
Related
Published
2026-06-05T19:07:56Z
Modified
2026-08-12T03:30:40Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
Details

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-426"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11401.json"
}
References

Affected packages

Git / github.com/aws/aws-advanced-go-wrapper

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-advanced-go-wrapper
Events
Introduced
5d5c15fb42af8bb6e818af635b54972571280e6e
Fixed
82f2d71a4b378ffd6fbe1b5ab4ce1b774a5e5137
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2026-04-06"
        },
        {
            "fixed": "2026-05-26"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11401.json"