{"id":"GHSA-fhr2-6r5v-gm9f","kind":"vulnerability","aliases":["GHSA-fhr2-6r5v-gm9f"],"related":[],"title":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper","description":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\n### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\nBulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST\n\n Description:\n\nAWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.\n\nWe identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.\n\nImpacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)\n\nResolution:\n\nThis issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.\n\nReferences:\n\n- CVE-2026-126793\n- GHSA-fhr2-6r5v-gm9f\n\nAcknowledgement:\n\nWe would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"The AWS Advanced Go Wrapper, a Go driver wrapper for Amazon Aurora PostgreSQL, has a flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate privileges to that user, including rds_superuser membership.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aurora-postgresql","aws","database","go","lab-disclosure","package"],"not_affected_if":["fixed-version","not-using-aws-go-wrapper","trusted-db-users-only"],"how_to_check":"- Check the awssql/v2 version in your `go.mod` for the AWS Advanced Go Wrapper; affected versions are `>= 2.0.0` and `< 2.0.3`.\n- Confirm whether any application connects to Aurora PostgreSQL through the wrapper.","fix":"- AWS Advanced Go Wrapper (awssql/v2): upgrade to `2.0.3` (release 2026-07-29) or later.\n- If you cannot upgrade immediately, the source suggests revoking CREATE on the public schema from PUBLIC and granting CREATE on other search_path schemas only to trusted users.","status":"open","published_at":null,"first_seen_at":"2026-11-12T21:28:58+00:00","triaged_at":"2026-11-12T21:29:44+00:00","updated_at":"2026-11-12T21:29:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T21:29:44Z","model":"claude-haiku-5-5","output":{"fix":"- AWS Advanced Go Wrapper (awssql/v2): upgrade to `2.0.3` (release 2026-07-29) or later.\n- If you cannot upgrade immediately, the source suggests revoking CREATE on the public schema from PUBLIC and granting CREATE on other search_path schemas only to trusted users.","reach":"network","title":"AWS Advanced Go Wrapper: Aurora PostgreSQL dialect detection lets users escalate privileges","impact":"high","summary":"The AWS Advanced Go Wrapper, a Go driver wrapper for Amazon Aurora PostgreSQL, has a flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate privileges to that user, including rds_superuser membership.","audience":"developers","category":"package","nicknames":[],"who_cares":["aws","aurora-postgresql","go","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged database user escalates to rds_superuser on Aurora","analyst_note":"","how_to_check":"- Check the awssql/v2 version in your `go.mod` for the AWS Advanced Go Wrapper; affected versions are `>= 2.0.0` and `< 2.0.3`.\n- Confirm whether any application connects to Aurora PostgreSQL through the wrapper.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-aws-go-wrapper","fixed-version","trusted-db-users-only"],"who_is_affected":"Applications that use the AWS Advanced Go Wrapper to connect to Aurora PostgreSQL clusters on affected versions are exposed. The risk requires an authenticated database user who can create functions in a schema on another user's search path, so teams with locked-down schemas and trusted-only database users are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00088,"input_tokens":5340,"output_tokens":691,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':175C,238C '-06':176C,239C '-07':182C,242C,261C '-126793':3A,85C,100C,159C,342C '-182':116C '-2026':2A,84C,99C,158C,341C '-29':183C,243C,262C '00':129C '11/12/2026':127C '13':128C '2.0.0':245C '2.0.3':247C '2026':115C,174C,181C,237C,241C,260C,268C '29':267C '6r5v':19A,24A,346C 'acknowledg':348C 'address':253C 'advanc':13A,38B,95C,110C,134C,169C,256C,331C 'affect':230C 'amazon':46B,151C 'anoth':68B,197C 'arpit':354C 'arpitjain099':356C 'attent':124C 'aurora':7A,27B,47B,89C,104C,152C,163C,225C 'aurora-postgresql':26B 'authent':57B,186C 'aw':12A,29B,37B,94C,109C,117C,119C,133C,168C,255C,330C 'aws-security@amazon.com':370C 'awssql/v2':244C 'awssql/v2.0.0':177C 'awssql/v2.0.3':184C,263C 'bulletin':113C 'cannot':293C 'cluster':154C,227C 'code':282C 'collabor':358C 'concern':377C 'connect':149C,222C,328C 'content':120C 'coordin':364C 'creat':62B,191C,298C,307C,315C 'custom':146C 'cve':1A,83C,98C,157C,340C 'databas':30B,58B,142C,187C,198C,325C,337C 'date':126C 'deriv':281C 'descript':132C 'detect':10A,55B,92C,107C,166C 'dialect':9A,54B,91C,106C,165C 'disclosur':34B,366C 'driver':43B,143C 'ecur':374C 'email':369C 'ensur':277C 'escal':5A,74B,87C,102C,204C 'fhr2':18A,23A,345C 'fix':289C 'flaw':51B 'fork':279C 'function':63B,192C 'ghsa':17A,22A,344C 'ghsa-fhr2-6r5v-gm9f':16A,21A,343C 'gm9f':20A,25A,347C 'go':14A,31B,39B,42B,96C,111C,135C,141C,170C,257C,332C 'grant':314C 'id':114C 'identifi':156C 'immedi':295C 'impact':235C 'import':122C 'includ':79B,211C 'incorpor':286C 'issu':161C,250C,361C 'jain':355C 'juli':266C 'lab':33B 'lab-disclosur':32B 'latest':274C 'like':351C 'member':213C 'membership':82B 'might':203C 'new':288C 'open':139C 'packag':35B 'patch':284C 'path':72B,202C,323C 'pleas':368C 'pm':130C 'postgresql':8A,28B,48B,90C,105C,153C,164C,226C 'privileg':4A,75B,86C,101C,205C,299C 'process':367C 'pst':131C 'public':125C,302C,305C,310C,312C 'question':375C 'rds':80B,216C 'recommend':270C 'refer':339C 'releas':173C,180C,259C,264C 'requir':123C 'resolut':248C 'revok':296C,306C 'role':218C 'schema':66B,195C,303C,309C,319C 'scope':118C 'search':71B,201C,322C 'sourc':140C 'superus':81B,217C 'thank':353C 'trust':336C 'type':121C 'upgrad':271C,294C 'use':147C 'user':59B,69B,78B,188C,199C,210C,221C,326C,338C 'version':231C,236C,275C 'vulner':365C 'workaround':290C 'would':350C 'wrapper':15A,40B,44B,97C,112C,136C,144C,171C,234C,258C,333C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the AWS Advanced Go Wrapper to connect to Aurora PostgreSQL clusters on affected versions are exposed. The risk requires an authenticated database user who can create functions in a schema on another user's search path, so teams with locked-down schemas and trusted-only database users are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aurorapostgresql","aws","database","go","labdisclosure","medium","package"],"campaign_type":null,"search_a":"'-126793':3A '-2026':2A '6r5v':19A,24A 'advanc':13A 'aurora':7A 'aw':12A 'cve':1A 'detect':10A 'dialect':9A 'escal':5A 'fhr2':18A,23A 'ghsa':17A,22A 'ghsa-fhr2-6r5v-gm9f':16A,21A 'gm9f':20A,25A 'go':14A 'postgresql':8A 'privileg':4A 'wrapper':15A","search_b":"'advanc':38B 'amazon':46B 'anoth':68B 'aurora':27B,47B 'aurora-postgresql':26B 'authent':57B 'aw':29B,37B 'creat':62B 'databas':30B,58B 'detect':55B 'dialect':54B 'disclosur':34B 'driver':43B 'escal':74B 'flaw':51B 'function':63B 'go':31B,39B,42B 'includ':79B 'lab':33B 'lab-disclosur':32B 'membership':82B 'packag':35B 'path':72B 'postgresql':28B,48B 'privileg':75B 'rds':80B 'schema':66B 'search':71B 'superus':81B 'user':59B,69B,78B 'wrapper':40B,44B","search_c":"'-04':175C,238C '-06':176C,239C '-07':182C,242C,261C '-126793':85C,100C,159C,342C '-182':116C '-2026':84C,99C,158C,341C '-29':183C,243C,262C '00':129C '11/12/2026':127C '13':128C '2.0.0':245C '2.0.3':247C '2026':115C,174C,181C,237C,241C,260C,268C '29':267C '6r5v':346C 'acknowledg':348C 'address':253C 'advanc':95C,110C,134C,169C,256C,331C 'affect':230C 'amazon':151C 'anoth':197C 'arpit':354C 'arpitjain099':356C 'attent':124C 'aurora':89C,104C,152C,163C,225C 'authent':186C 'aw':94C,109C,117C,119C,133C,168C,255C,330C 'aws-security@amazon.com':370C 'awssql/v2':244C 'awssql/v2.0.0':177C 'awssql/v2.0.3':184C,263C 'bulletin':113C 'cannot':293C 'cluster':154C,227C 'code':282C 'collabor':358C 'concern':377C 'connect':149C,222C,328C 'content':120C 'coordin':364C 'creat':191C,298C,307C,315C 'custom':146C 'cve':83C,98C,157C,340C 'databas':142C,187C,198C,325C,337C 'date':126C 'deriv':281C 'descript':132C 'detect':92C,107C,166C 'dialect':91C,106C,165C 'disclosur':366C 'driver':143C 'ecur':374C 'email':369C 'ensur':277C 'escal':87C,102C,204C 'fhr2':345C 'fix':289C 'fork':279C 'function':192C 'ghsa':344C 'ghsa-fhr2-6r5v-gm9f':343C 'gm9f':347C 'go':96C,111C,135C,141C,170C,257C,332C 'grant':314C 'id':114C 'identifi':156C 'immedi':295C 'impact':235C 'import':122C 'includ':211C 'incorpor':286C 'issu':161C,250C,361C 'jain':355C 'juli':266C 'latest':274C 'like':351C 'member':213C 'might':203C 'new':288C 'open':139C 'patch':284C 'path':202C,323C 'pleas':368C 'pm':130C 'postgresql':90C,105C,153C,164C,226C 'privileg':86C,101C,205C,299C 'process':367C 'pst':131C 'public':125C,302C,305C,310C,312C 'question':375C 'rds':216C 'recommend':270C 'refer':339C 'releas':173C,180C,259C,264C 'requir':123C 'resolut':248C 'revok':296C,306C 'role':218C 'schema':195C,303C,309C,319C 'scope':118C 'search':201C,322C 'sourc':140C 'superus':217C 'thank':353C 'trust':336C 'type':121C 'upgrad':271C,294C 'use':147C 'user':188C,199C,210C,221C,326C,338C 'version':231C,236C,275C 'vulner':365C 'workaround':290C 'would':350C 'wrapper':97C,112C,136C,144C,171C,234C,258C,333C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/#GHSA-fhr2-6r5v-gm9f","url":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T21:28:58+00:00","fetched_at":"2026-11-12T21:28:58+00:00","note":"AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper"}],"documents":[{"id":139193,"url":"https://aws.amazon.com/security/security-bulletins/2026-182-aws/","title":"AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\n### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper\n\nBulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST\n\n Description:\n\nAWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.\n\nWe identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.\n\nImpacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)\n\nResolution:\n\nThis issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.\n\nReferences:\n\n- CVE-2026-126793\n- GHSA-fhr2-6r5v-gm9f\n\nAcknowledgement:\n\nWe would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}