8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-11401

CVE-2026-11401: Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-11401

CVE-2026-11401:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/aws/aws-advanced-go-wrapper/awssql/v2	go	<= 2.0.0	2.0.1
github.com/aws/aws-advanced-go-wrapper/xray	go	<= 1.06	1.07

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-11401, is a privilege escalation issue in the AWS Advanced Go Wrapper for Aurora PostgreSQL, categorized as an Untrusted Search Path (CWE-426). The root cause is that the wrapper executes SQL queries calling PostgreSQL functions (aurora_global_db_status, aurora_global_db_instance_status) without explicitly specifying the pg_catalog schema.

An authenticated attacker with low privileges can create their own malicious versions of these functions in a schema that is part of the database's search_path before the pg_catalog schema (e.g., the default public schema). When the application uses the AWS Go Wrapper to connect to the database, the database will resolve the function call to the attacker's function instead of the legitimate one. This results in the execution of the attacker's code with the permissions of the application's database user, which could be a highly privileged role like rds_superuser.

The security patch, found in commit a07683f09f69e972a460640e5cc3845de7a97489, addresses this by explicitly qualifying all calls to these functions with the pg_catalog schema (e.g., pg_catalog.aurora_global_db_status()). This ensures that the correct, trusted function is always executed, regardless of the search_path configuration.

The analysis of the patch file awssql/driver_infrastructure/pg_database_dialects.go pinpointed three methods within the GlobalAuroraPgDatabaseDialect struct—IsDialect, GetTopologyQuery, and GetRegionByInstanceIdQuery—as the sources of the vulnerability. These functions are responsible for constructing the vulnerable SQL query strings that are later executed, making them the key indicators that would appear in a runtime profile during exploitation.

Vulnerable functions

GlobalAuroraPgDatabaseDialect.IsDialect

awssql/driver_infrastructure/pg_database_dialects.go

This function constructs and executes SQL queries to check for the existence of 'aurora_global_db_status' and 'aurora_global_db_instance_status' functions and then queries 'aurora_global_db_status' without specifying a schema. This allows an attacker to create a malicious function with the same name in the 'public' schema, which could be executed with the privileges of the application user, leading to privilege escalation.

GlobalAuroraPgDatabaseDialect.GetTopologyQuery

awssql/driver_infrastructure/pg_database_dialects.go

This function returns a SQL query string that queries the 'aurora_global_db_instance_status' function without specifying the 'pg_catalog' schema. An attacker could create a function with the same name in a public schema, which would be executed instead of the intended function, leading to a privilege escalation vulnerability.

GlobalAuroraPgDatabaseDialect.GetRegionByInstanceIdQuery

awssql/driver_infrastructure/pg_database_dialects.go

This function returns a SQL query string that queries the 'aurora_global_db_instance_status' function without specifying the 'pg_catalog' schema. This allows an attacker to execute a crafted function by placing it in a schema that is searched before 'pg_catalog', leading to privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.