EUVD-2026-34901
GHSA-r236-5pc3-3qcp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 05, 2026
Privilege escalation in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (GlobalDatabasePlugin) allows an authenticated low-privilege RDS user to gain the privileges of another user — including rds_superuser — by planting a malicious function on an untrusted search path that executes when the targeted user connects through the wrapper. The flaw is rated CVSS 4.0 8.6 (High) and requires user interaction (the victim must initiate a connection via the wrapper), with no public exploit identified at time of analysis. A vendor patch is available in release 2026-05-26.
Earlier versions of this analysis (2)
Privilege escalation in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL allows a low-privileged authenticated database user to gain rds_superuser or other higher-privileged RDS user permissions through the GlobalDatabasePlugin. The flaw stems from an untrusted search path (CWE-426) that causes a malicious function planted by the attacker to execute in the context of a victim user when that user connects to the cluster via the affected wrapper. No public exploit identified at time of analysis, and the issue requires victim user interaction (a higher-privileged connection through the wrapper) to trigger.
Privilege escalation in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (GlobalDatabasePlugin) allows an authenticated low-privilege RDS user to escalate to another user's privileges, including rds_superuser, by planting a crafted function in an untrusted search path that executes when a higher-privileged user connects through the wrapper. The flaw is rated CVSS 8.0 and requires user interaction (a target connecting via the affected wrapper), with no public exploit identified at time of analysis. AWS has released a fix in the 2026-05-26 release of the wrapper.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when AWS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
3DescriptionCVE.org
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.
To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26
Executive ViewAI
AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL contains a privilege escalation vulnerability (CVSS 8.6) that allows authenticated low-privilege RDS users to assume superuser privileges, potentially compromising database integrity and data confidentiality. This impacts organizations using this wrapper with Aurora PostgreSQL, particularly those with multiple privilege levels or untrusted users within their RDS environments. A vendor patch is available and should be prioritized for immediate deployment.
Within 24 hours: Identify all systems running AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL and document current versions in use. Within 7 days: Begin staged deployment of vendor patch version 2026-05-26 to non-production environments and validate functionality. Within 30 days: Complete full deployment to all production Aurora PostgreSQL instances using the wrapper and confirm successful updates.
Apply vendor patch version 2026-05-26.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Loom for AWS deployments running a version before 1.6.1 with no identity provider configured expose an unauthenticated s
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attacke
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB