CVE-2026-11401: AWS Advanced Go Wrapper Privilege Escalation

CVE-2026-11401 Overview

CVE-2026-11401 is an untrusted search path vulnerability [CWE-426] in the GlobalDatabasePlugin component of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. A remote authenticated low-privilege actor can escalate privileges to those of another Amazon RDS user, including rds_superuser. The attacker creates a crafted function that executes when a higher-privileged user connects to the cluster through the affected wrapper.

Critical Impact
Low-privilege database users can escalate to rds_superuser, gaining full administrative control over the Aurora PostgreSQL cluster and any data within it.

Affected Products

AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (releases prior to 2026-05-26)
Amazon Aurora PostgreSQL clusters accessed through the affected wrapper
Applications using the GlobalDatabasePlugin from the AWS Advanced Go Wrapper

Discovery Timeline

2026-06-05 - CVE-2026-11401 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11401

Vulnerability Analysis

The vulnerability resides in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper. The plugin executes SQL operations during connection establishment without enforcing a trusted search_path. PostgreSQL resolves unqualified object references using the session search_path, which the calling user controls. An attacker who controls a schema in the search_path can shadow legitimate functions with malicious equivalents.

When a privileged user, including rds_superuser, connects through the wrapper, the plugin invokes the shadowed function under the privileged user's session. The malicious function then executes arbitrary SQL with the elevated privileges of the connecting user. This converts an ordinary database account into a full administrative compromise of the cluster.

Root Cause

The root cause is improper handling of the PostgreSQL search_path within the GlobalDatabasePlugin. The plugin issues SQL statements that reference functions or operators without schema qualification. This pattern matches CWE-426 (Untrusted Search Path), where a privileged process resolves resources through paths an unprivileged actor can manipulate.

Attack Vector

The attacker must hold valid low-privilege credentials on the Aurora PostgreSQL cluster. The attacker creates a function in a schema they own and adjusts the search_path so their schema is preferred. The attack triggers when a higher-privileged user connects to the cluster through the affected wrapper. User interaction by the victim user is required, which is the connection itself.

The attack does not require local access or elevated permissions to stage. Exploitation produces high impact on confidentiality, integrity, and availability of the database, since rds_superuser controls schemas, roles, and stored data.

Detection Methods for CVE-2026-11401

Indicators of Compromise

Creation of functions in user-owned schemas with names matching PostgreSQL built-ins or wrapper-invoked functions
Unexpected modifications to the search_path parameter at the role or database level via ALTER ROLE ... SET search_path or ALTER DATABASE ... SET search_path
Audit log entries showing rds_superuser or other privileged roles executing SQL originating from non-administrative schemas
Application connections using vulnerable AWS Advanced Go Wrapper versions released before 2026-05-26

Detection Strategies

Enumerate all functions in non-system schemas and compare names against built-in and plugin-invoked functions for shadowing attempts
Query pg_db_role_setting and pg_roles to identify accounts with non-default search_path configurations
Review Amazon RDS PostgreSQL audit logs (pgaudit) for function calls executed by privileged users that resolve to user-owned schemas
Inventory Go applications and verify the wrapper version against release 2026-05-26 or later

Monitoring Recommendations

Enable pgaudit with object-level logging for FUNCTION and DDL classes on Aurora PostgreSQL clusters
Ship Aurora audit and PostgreSQL logs to a centralized SIEM and alert on CREATE FUNCTION events in user schemas that mirror built-in names
Alert on any ALTER ROLE or ALTER DATABASE statement modifying search_path
Monitor connection metadata to track which application versions and wrapper versions are accessing each cluster

How to Mitigate CVE-2026-11401

Immediate Actions Required

Upgrade the AWS Advanced Go Wrapper to release 2026-05-26 or later across all applications connecting to Aurora PostgreSQL
Audit existing database roles and revoke CREATE privilege on the public schema from low-privilege accounts
Review and reset any search_path settings on privileged roles back to the default of "$user", public
Inventory functions in user schemas and remove any that shadow built-in or plugin-invoked functions

Patch Information

AWS released the fix in the AWS Advanced Go Wrapper release dated 2026-05-26. Refer to the GitHub Release Notes 2026-05-26, the GitHub Security Advisory GHSA-r236-5pc3-3qcp, and the AWS Security Bulletin 2026-039 for full details.

Workarounds

Restrict CREATE privilege on schemas reachable through the default search_path for all non-administrative roles
Set an explicit, schema-qualified search_path on privileged roles using ALTER ROLE rds_superuser SET search_path = pg_catalog, public
Limit cluster access to trusted application accounts and avoid sharing the cluster with untrusted low-privilege users until the wrapper is upgraded
Use connection routing that bypasses the GlobalDatabasePlugin where feasible until patching is complete

bash

# Configuration example
# Revoke CREATE on public schema from low-privilege roles
psql -h cluster.cluster-xyz.us-east-1.rds.amazonaws.com -U admin -d postgres -c \
  "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"

# Pin a safe search_path on privileged roles
psql -h cluster.cluster-xyz.us-east-1.rds.amazonaws.com -U admin -d postgres -c \
  "ALTER ROLE rds_superuser SET search_path = pg_catalog, public;"

# Update Go application dependency
go get github.com/aws/aws-advanced-go-wrapper@release-2026-05-26
go mod tidy