GHSA-fhr2-6r5v-gm9f · Package
NO FIX YET · SEE WHAT TO DO
The AWS Advanced Go Wrapper, a Go driver wrapper for Amazon Aurora PostgreSQL, has a flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate privileges to that user, including rds_superuser membership.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the AWS Advanced Go Wrapper to connect to Aurora PostgreSQL clusters on affected versions are exposed. The risk requires an authenticated database user who can create functions in a schema on another user's search path, so teams with locked-down schemas and trusted-only database users are less exposed.
Not affected if fixed-version, not-using-aws-go-wrapper, trusted-db-users-only
Who cares aurora-postgresql, aws, database, go, lab-disclosure
go.mod for the AWS Advanced Go Wrapper; affected versions are >= 2.0.0 and < 2.0.3.2.0.3 (release 2026-07-29) or later.CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
Bulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST
Description:
AWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.
We identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.
Impacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)
Resolution:
This issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
If you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.
References:
Acknowledgement:
We would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Please email aws-security@amazon.com with any s ecurity questions or concerns.