Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-06 | 2 | Disclosure2 |
| 2026-06-08 | 1 | Disclosure1 |
CVE-2026-11400 and CVE-2026-11401 - Privilege Escalation in Aurora PostgreSQL using AWS Advanced JDBC Wrapper, AWS Advanced Go Wrapper https://aws.amazon.com/security/security-bulletins/2026-039-aws/
Post summary
The text announces the identification of two privilege‑escalation CVEs affecting Aurora PostgreSQL via AWS Advanced JDBC and Go wrappers.
CVE-2026-11401 An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege… https://www.cve.org/CVERecord?id=CVE-2026-11401
Post summary
The tweet announces CVE-2026-11401 as an untrusted search path issue in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL, with no mention of PoC, exploit code, patch, or active exploitation.
CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora Postgr... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11401 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A new privilege escalation vulnerability (CVE-2026-11401) in AWS's Aurora Postgres Go wrapper has been reported, with a notification link provided.