CVE-2026-126793 · Package
NO FIX YET · SEE WHAT TO DO
AWS Advanced Go Wrapper, a Go driver for Amazon Aurora PostgreSQL, has a privilege escalation flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate to that user's privileges, including rds_superuser membership, when that user connects through an affected wrapper version.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications written in Go that use the AWS Advanced Go Wrapper to connect to Amazon Aurora PostgreSQL clusters on affected versions. The exposure depends on database users who can create functions in a schema on another user's search path, so teams with tightly controlled schema privileges are less at risk. Teams that cannot upgrade immediately can revoke CREATE on the public schema from PUBLIC, as the AWS bulletin describes.
Not affected if awssql-2.0.3-or-later, no-aurora-postgresql, schema-create-restricted
Who cares aurora-postgresql, aws, go, lab-disclosure, postgresql
2.0.0 or later but before 2.0.3.2.0.3 or later.CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
Bulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST
Description:
AWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.
We identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.
Impacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)
Resolution:
This issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
If you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.
References:
Acknowledgement:
We would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Please email aws-security@amazon.com with any s ecurity questions or concerns.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.