---
id: "CVE-2026-126793"
page: "https://infrastack.ai/live/CVE-2026-126793"
kind: "vulnerability"
aliases: ["CVE-2026-126793"]
title: "An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release\u2026"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aurora-postgresql", "aws", "go", "lab-disclosure", "package", "postgresql"]
not_affected_if: ["awssql-2.0.3-or-later", "no-aurora-postgresql", "schema-create-restricted"]
published_at: "2026-11-12T21:17:22+00:00"
first_seen_at: "2026-11-12T21:28:58+00:00"
updated_at: "2026-11-12T21:52:11+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/2026-182-aws/", "first_seen_at": "2026-11-12T21:28:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126793", "first_seen_at": "2026-11-12T21:40:31+00:00"}]
exploit_sources: []
---

# An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release…

Link for people: https://infrastack.ai/live/CVE-2026-126793 (this .md is for agents)

AWS Advanced Go Wrapper, a Go driver for Amazon Aurora PostgreSQL, has a privilege escalation flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate to that user's privileges, including rds_superuser membership, when that user connects through an affected wrapper version.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of awssql/v2 in your go.mod file, affected if it is `2.0.0` or later but before `2.0.3`.
- Check whether your PostgreSQL search_path includes schemas where non-trusted users can CREATE functions, including the public schema.

## Fix

- Upgrade AWS Advanced Go Wrapper (awssql/v2) to `2.0.3` or later.
- Patch any forked or derivative code to incorporate the fixes, per the AWS bulletin.

## Timeline

- 2026-11-12T21:28:58+00:00 lab https://aws.amazon.com/security/security-bulletins/2026-182-aws/ — AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
- 2026-11-12T21:40:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126793

## Documents

- [advisory] AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper https://aws.amazon.com/security/security-bulletins/2026-182-aws/
- [advisory] Vendor advisory: github.com https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-fhr2-6r5v-gm9f
- [advisory] AWS Security Bulletins: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper https://aws.amazon.com/security/security-bulletins/rss/2026-182-aws/
- [fix] Release notes: github.com https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-07-29

## From the sources

CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

Bulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST

 Description:

AWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.

We identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.

Impacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)

Resolution:

This issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

If you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.

References:

- CVE-2026-126793
- GHSA-fhr2-6r5v-gm9f

Acknowledgement:

We would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any s ecurity questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_