CVE-2026-11400: AWS JDBC Wrapper Privilege Escalation Flaw

CVE-2026-11400 Overview

CVE-2026-11400 is an untrusted search path vulnerability [CWE-426] in the GlobalDatabasePlugin component of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL. A remote, authenticated low-privilege actor can escalate privileges to those of another Amazon RDS user, including rds_superuser. The attacker creates a crafted function that executes when a higher-privileged user connects to the cluster through an affected wrapper. AWS has published Security Bulletin 2026-039 and released a fix in version 4.0.1 of the wrapper.

Critical Impact
Low-privilege database users can hijack connections from administrative accounts and execute arbitrary SQL with rds_superuser privileges, leading to full compromise of the Aurora PostgreSQL cluster.

Affected Products

AWS Advanced JDBC Wrapper versions prior to 4.0.1
Amazon Aurora PostgreSQL clusters accessed through the affected wrapper
Applications using the GlobalDatabasePlugin for cluster routing

Discovery Timeline

2026-06-05 - CVE-2026-11400 published to NVD
2026-06-05 - Last updated in NVD database
2026-06-05 - AWS Security Bulletin 2026-039 released alongside wrapper version 4.0.1

Technical Details for CVE-2026-11400

Vulnerability Analysis

The AWS Advanced JDBC Wrapper provides plugin-based functionality for Amazon Aurora connectivity, including failover, read/write splitting, and global database routing. The GlobalDatabasePlugin issues SQL queries against the target cluster during connection establishment to discover cluster topology and routing state.

The vulnerability stems from an untrusted search path used when the plugin executes these internal queries. PostgreSQL resolves unqualified object references against the search_path setting, which by default includes schemas writable by lower-privileged users. A low-privilege actor can plant a function with the same name as one the plugin invokes during a privileged user's connection setup. When an administrator connects through the wrapper, the planted function executes in the administrator's session with that user's privileges.

Root Cause

The root cause is improper resolution of database objects without fully qualified schema names or a hardened search_path [CWE-426]. The GlobalDatabasePlugin issues queries that reference functions or relations the attacker can shadow in a user-writable schema. PostgreSQL's name resolution then selects the attacker-controlled object over the intended built-in.

Attack Vector

Exploitation requires the attacker to hold a low-privilege RDS account on the target Aurora PostgreSQL cluster. The attacker creates a malicious function in a schema referenced by the default search_path, such as public. The function payload executes arbitrary SQL using SECURITY INVOKER semantics, inheriting the connecting user's role. When an rds_superuser or other higher-privileged account connects to the cluster through an affected version of the wrapper, the GlobalDatabasePlugin triggers the malicious function. The attacker gains execution under the privileged role, allowing role grants, data exfiltration, or modification of cluster-wide settings.

For full technical details, see the AWS Security Bulletin 2026-039 and the GitHub Release Notes 4.0.1.

Detection Methods for CVE-2026-11400

Indicators of Compromise

Unexpected functions or procedures in the public schema or other writable schemas owned by non-administrative roles.
PostgreSQL audit log entries showing function creation by low-privilege users shortly before administrator logins.
Unexplained role grants, password changes, or ALTER ROLE statements executed in rds_superuser sessions.
Application connections originating from JDBC clients using AWS Advanced JDBC Wrapper versions earlier than 4.0.1.

Detection Strategies

Inventory all applications and CI/CD pipelines that bundle the AWS Advanced JDBC Wrapper and compare versions against 4.0.1.
Enable pgaudit on Aurora PostgreSQL clusters to log DDL and function execution events for review.
Hunt for objects in user-writable schemas whose names collide with built-in PostgreSQL functions referenced by the wrapper's plugins.
Correlate function creation events with subsequent privileged connections from JDBC client hosts.

Monitoring Recommendations

Forward Amazon RDS PostgreSQL logs and pgaudit events to a centralized analytics pipeline for ongoing review.
Alert on CREATE FUNCTION or CREATE PROCEDURE statements executed in shared schemas by non-administrative roles.
Monitor changes to search_path settings at the database, role, and session level.
Track new role memberships granting rds_superuser or equivalent privileges.

How to Mitigate CVE-2026-11400

Immediate Actions Required

Upgrade the AWS Advanced JDBC Wrapper to version 4.0.1 in all applications and container images.
Audit Aurora PostgreSQL clusters for unauthorized functions in user-writable schemas and remove suspicious objects.
Review recent rds_superuser session activity for unexpected DDL or role changes.
Rotate credentials for any administrative accounts that connected through vulnerable wrapper versions.

Patch Information

AWS released the fix in AWS Advanced JDBC Wrapper version 4.0.1. Update Maven, Gradle, or other dependency manifests to pull the patched artifact and rebuild affected applications. Refer to the GitHub Release Notes 4.0.1 for upgrade guidance and the CVE Record CVE-2026-11400 for authoritative metadata.

Workarounds

Restrict CREATE privilege on the public schema with REVOKE CREATE ON SCHEMA public FROM PUBLIC to prevent function planting.
Set an explicit, minimal search_path for administrative roles using ALTER ROLE <admin> SET search_path = pg_catalog, "$user".
Limit use of the GlobalDatabasePlugin until all clients are upgraded to 4.0.1.
Apply least-privilege role design so that application accounts cannot create objects in shared schemas.

bash

# Configuration example: harden search_path and revoke public schema writes
psql -h <cluster-endpoint> -U rds_superuser -d postgres <<'SQL'
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
ALTER ROLE rds_superuser SET search_path = pg_catalog, "$user";
SQL