{"id":"CVE-2026-126793","kind":"vulnerability","aliases":["CVE-2026-126793"],"related":[],"title":"An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release…","description":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\n### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\nBulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST\n\n Description:\n\nAWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.\n\nWe identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.\n\nImpacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)\n\nResolution:\n\nThis issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.\n\nReferences:\n\n- CVE-2026-126793\n- GHSA-fhr2-6r5v-gm9f\n\nAcknowledgement:\n\nWe would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"AWS Advanced Go Wrapper, a Go driver for Amazon Aurora PostgreSQL, has a privilege escalation flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate to that user's privileges, including rds_superuser membership, when that user connects through an affected wrapper version.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aurora-postgresql","aws","go","lab-disclosure","package","postgresql"],"not_affected_if":["awssql-2.0.3-or-later","no-aurora-postgresql","schema-create-restricted"],"how_to_check":"- Check the version of awssql/v2 in your go.mod file, affected if it is `2.0.0` or later but before `2.0.3`.\n- Check whether your PostgreSQL search_path includes schemas where non-trusted users can CREATE functions, including the public schema.","fix":"- Upgrade AWS Advanced Go Wrapper (awssql/v2) to `2.0.3` or later.\n- Patch any forked or derivative code to incorporate the fixes, per the AWS bulletin.","status":"open","published_at":"2026-11-12T21:17:22+00:00","first_seen_at":"2026-11-12T21:28:58+00:00","triaged_at":"2026-11-12T21:29:43+00:00","updated_at":"2026-11-12T21:52:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T21:29:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AWS Advanced Go Wrapper (awssql/v2) to `2.0.3` or later.\n- Patch any forked or derivative code to incorporate the fixes, per the AWS bulletin.","reach":"network","title":"AWS Advanced Go Wrapper: search path flaw lets database users gain superuser rights","impact":"high","summary":"AWS Advanced Go Wrapper, a Go driver for Amazon Aurora PostgreSQL, has a privilege escalation flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate to that user's privileges, including rds_superuser membership, when that user connects through an affected wrapper version.","audience":"developers","category":"package","nicknames":[],"who_cares":["aws","aurora-postgresql","go","postgresql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Database user gains rds_superuser privileges on the Aurora cluster","analyst_note":"","how_to_check":"- Check the version of awssql/v2 in your go.mod file, affected if it is `2.0.0` or later but before `2.0.3`.\n- Check whether your PostgreSQL search_path includes schemas where non-trusted users can CREATE functions, including the public schema.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["awssql-2.0.3-or-later","no-aurora-postgresql","schema-create-restricted"],"who_is_affected":"Applications written in Go that use the AWS Advanced Go Wrapper to connect to Amazon Aurora PostgreSQL clusters on affected versions. The exposure depends on database users who can create functions in a schema on another user's search path, so teams with tightly controlled schema privileges are less at risk. Teams that cannot upgrade immediately can revoke CREATE on the public schema from PUBLIC, as the AWS bulletin describes.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000893,"input_tokens":5320,"output_tokens":723,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':184C,247C '-06':185C,248C '-07':191C,251C,270C '-126793':21A,24A,94C,109C,168C,351C '-182':125C '-2026':20A,23A,93C,108C,167C,350C '-29':192C,252C,271C '00':138C '11/12/2026':136C '13':137C '2.0.0':254C '2.0.3':256C '2026':124C,183C,190C,246C,250C,269C,277C '29':276C '6r5v':355C 'acknowledg':357C 'address':262C 'advanc':14A,36B,104C,119C,143C,178C,265C,340C 'affect':89B,239C 'amazon':43B,160C 'anoth':67B,206C 'arpit':363C 'arpitjain099':365C 'attent':133C 'aurora':7A,26B,44B,98C,113C,161C,172C,234C 'aurora-postgresql':25B 'authent':56B,195C 'aw':13A,28B,35B,103C,118C,126C,128C,142C,177C,264C,339C 'aws-security@amazon.com':379C 'awssql/v2':253C 'awssql/v2.0.0':186C 'awssql/v2.0.3':193C,272C 'bulletin':122C 'cannot':302C 'cluster':163C,236C 'code':291C 'collabor':367C 'concern':386C 'connect':86B,158C,231C,337C 'content':129C 'coordin':373C 'creat':61B,200C,307C,316C,324C 'custom':155C 'cve':19A,22A,92C,107C,166C,349C 'databas':57B,151C,196C,207C,334C,346C 'date':135C 'deriv':290C 'descript':141C 'detect':10A,54B,101C,116C,175C 'dialect':9A,53B,100C,115C,174C 'disclosur':32B,375C 'driver':41B,152C 'ecur':383C 'email':378C 'ensur':286C 'escal':49B,73B,96C,111C,213C 'fhr2':354C 'fix':298C 'flaw':50B 'fork':288C 'function':62B,201C 'ghsa':353C 'ghsa-fhr2-6r5v-gm9f':352C 'gm9f':356C 'go':15A,29B,37B,40B,105C,120C,144C,150C,179C,266C,341C 'grant':323C 'id':123C 'identifi':165C 'immedi':304C 'impact':244C 'import':131C 'includ':79B,220C 'incorpor':295C 'issu':5A,170C,259C,370C 'jain':364C 'juli':275C 'lab':31B 'lab-disclosur':30B 'latest':283C 'like':360C 'member':222C 'membership':82B 'might':212C 'new':297C 'open':148C 'packag':33B 'patch':293C 'path':4A,71B,211C,332C 'pleas':377C 'pm':139C 'postgresql':8A,27B,34B,45B,99C,114C,162C,173C,235C 'privileg':48B,78B,95C,110C,214C,308C 'process':376C 'pst':140C 'public':134C,311C,314C,319C,321C 'question':384C 'rds':80B,225C 'recommend':279C 'refer':348C 'releas':18A,182C,189C,268C,273C 'requir':132C 'resolut':257C 'revok':305C,315C 'role':227C 'schema':65B,204C,312C,318C,328C 'scope':127C 'search':3A,70B,210C,331C 'sourc':149C 'superus':81B,226C 'thank':362C 'trust':345C 'type':130C 'untrust':2A 'upgrad':280C,303C 'use':156C 'user':58B,68B,76B,85B,197C,208C,219C,230C,335C,347C 'version':91B,240C,245C,284C 'vulner':374C 'workaround':299C 'would':359C 'wrapper':16A,38B,90B,106C,121C,145C,153C,180C,243C,267C,342C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Go that use the AWS Advanced Go Wrapper to connect to Amazon Aurora PostgreSQL clusters on affected versions. The exposure depends on database users who can create functions in a schema on another user's search path, so teams with tightly controlled schema privileges are less at risk. Teams that cannot upgrade immediately can revoke CREATE on the public schema from PUBLIC, as the AWS bulletin describes.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aurorapostgresql","aws","go","high","labdisclosure","package","postgresql"],"campaign_type":null,"search_a":"'-126793':21A,24A '-2026':20A,23A 'advanc':14A 'aurora':7A 'aw':13A 'cve':19A,22A 'detect':10A 'dialect':9A 'go':15A 'issu':5A 'path':4A 'postgresql':8A 'releas':18A 'search':3A 'untrust':2A 'wrapper':16A","search_b":"'advanc':36B 'affect':89B 'amazon':43B 'anoth':67B 'aurora':26B,44B 'aurora-postgresql':25B 'authent':56B 'aw':28B,35B 'connect':86B 'creat':61B 'databas':57B 'detect':54B 'dialect':53B 'disclosur':32B 'driver':41B 'escal':49B,73B 'flaw':50B 'function':62B 'go':29B,37B,40B 'includ':79B 'lab':31B 'lab-disclosur':30B 'membership':82B 'packag':33B 'path':71B 'postgresql':27B,34B,45B 'privileg':48B,78B 'rds':80B 'schema':65B 'search':70B 'superus':81B 'user':58B,68B,76B,85B 'version':91B 'wrapper':38B,90B","search_c":"'-04':184C,247C '-06':185C,248C '-07':191C,251C,270C '-126793':94C,109C,168C,351C '-182':125C '-2026':93C,108C,167C,350C '-29':192C,252C,271C '00':138C '11/12/2026':136C '13':137C '2.0.0':254C '2.0.3':256C '2026':124C,183C,190C,246C,250C,269C,277C '29':276C '6r5v':355C 'acknowledg':357C 'address':262C 'advanc':104C,119C,143C,178C,265C,340C 'affect':239C 'amazon':160C 'anoth':206C 'arpit':363C 'arpitjain099':365C 'attent':133C 'aurora':98C,113C,161C,172C,234C 'authent':195C 'aw':103C,118C,126C,128C,142C,177C,264C,339C 'aws-security@amazon.com':379C 'awssql/v2':253C 'awssql/v2.0.0':186C 'awssql/v2.0.3':193C,272C 'bulletin':122C 'cannot':302C 'cluster':163C,236C 'code':291C 'collabor':367C 'concern':386C 'connect':158C,231C,337C 'content':129C 'coordin':373C 'creat':200C,307C,316C,324C 'custom':155C 'cve':92C,107C,166C,349C 'databas':151C,196C,207C,334C,346C 'date':135C 'deriv':290C 'descript':141C 'detect':101C,116C,175C 'dialect':100C,115C,174C 'disclosur':375C 'driver':152C 'ecur':383C 'email':378C 'ensur':286C 'escal':96C,111C,213C 'fhr2':354C 'fix':298C 'fork':288C 'function':201C 'ghsa':353C 'ghsa-fhr2-6r5v-gm9f':352C 'gm9f':356C 'go':105C,120C,144C,150C,179C,266C,341C 'grant':323C 'id':123C 'identifi':165C 'immedi':304C 'impact':244C 'import':131C 'includ':220C 'incorpor':295C 'issu':170C,259C,370C 'jain':364C 'juli':275C 'latest':283C 'like':360C 'member':222C 'might':212C 'new':297C 'open':148C 'patch':293C 'path':211C,332C 'pleas':377C 'pm':139C 'postgresql':99C,114C,162C,173C,235C 'privileg':95C,110C,214C,308C 'process':376C 'pst':140C 'public':134C,311C,314C,319C,321C 'question':384C 'rds':225C 'recommend':279C 'refer':348C 'releas':182C,189C,268C,273C 'requir':132C 'resolut':257C 'revok':305C,315C 'role':227C 'schema':204C,312C,318C,328C 'scope':127C 'search':210C,331C 'sourc':149C 'superus':226C 'thank':362C 'trust':345C 'type':130C 'upgrad':280C,303C 'use':156C 'user':197C,208C,219C,230C,335C,347C 'version':240C,245C,284C 'vulner':374C 'workaround':299C 'would':359C 'wrapper':106C,121C,145C,153C,180C,243C,267C,342C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T21:07:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/#CVE-2026-126793","url":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T21:28:58+00:00","fetched_at":"2026-11-12T21:28:58+00:00","note":"AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper"},{"source":"nvd","external_id":"CVE-2026-126793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126793","severity":null,"published_at":"2026-11-12T21:17:22+00:00","modified_at":"2026-11-12T21:17:22+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","fetched_at":"2026-11-12T21:40:32+00:00","note":null}],"documents":[{"id":139193,"url":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/","title":"AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\n### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\nBulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST\n\n Description:\n\nAWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.\n\nWe identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.\n\nImpacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)\n\nResolution:\n\nThis issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.\n\nReferences:\n\n- CVE-2026-126793\n- GHSA-fhr2-6r5v-gm9f\n\nAcknowledgement:\n\nWe would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":139268,"url":"https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-07-29","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":139269,"url":"https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-fhr2-6r5v-gm9f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T21:07:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":139423,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-182-aws/","title":"AWS Security Bulletins: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper","kind":"vendor","source":"vendor","publisher":null,"text":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\nBulletin ID: 2026-182-AWS Publication Date: 11/12/2026 13:00 PM PST Description: An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. Impacted versions: AWS Advanced Go Wrapper >=2026-04-06, <2026-07-29 Refer to the article for the most up-to-date and complete information.","published_at":"2026-11-12T21:11:28+00:00","relation":"advisory","confidence":null,"note":"AWS Security Bulletins"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}