---
id: "GHSA-fhr2-6r5v-gm9f"
page: "https://infrastack.ai/live/GHSA-fhr2-6r5v-gm9f"
kind: "vulnerability"
aliases: ["GHSA-fhr2-6r5v-gm9f"]
title: "CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aurora-postgresql", "aws", "database", "go", "lab-disclosure", "package"]
not_affected_if: ["fixed-version", "not-using-aws-go-wrapper", "trusted-db-users-only"]
published_at: null
first_seen_at: "2026-11-12T21:28:58+00:00"
updated_at: "2026-11-12T21:29:44+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/2026-182-aws/", "first_seen_at": "2026-11-12T21:28:58+00:00"}]
exploit_sources: []
---

# CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

Link for people: https://infrastack.ai/live/GHSA-fhr2-6r5v-gm9f (this .md is for agents)

The AWS Advanced Go Wrapper, a Go driver wrapper for Amazon Aurora PostgreSQL, has a flaw in its dialect detection. An authenticated database user who can create functions in a schema on another user's search path can escalate privileges to that user, including rds_superuser membership.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the awssql/v2 version in your `go.mod` for the AWS Advanced Go Wrapper; affected versions are `>= 2.0.0` and `< 2.0.3`.
- Confirm whether any application connects to Aurora PostgreSQL through the wrapper.

## Fix

- AWS Advanced Go Wrapper (awssql/v2): upgrade to `2.0.3` (release 2026-07-29) or later.
- If you cannot upgrade immediately, the source suggests revoking CREATE on the public schema from PUBLIC and granting CREATE on other search_path schemas only to trusted users.

## Timeline

- 2026-11-12T21:28:58+00:00 lab https://aws.amazon.com/security/security-bulletins/2026-182-aws/ — AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

## Documents

- [advisory] AWS: CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper https://aws.amazon.com/security/security-bulletins/2026-182-aws/

## From the sources

CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

### CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

Bulletin ID: 2026-182-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 13:00 PM PST

 Description:

AWS Advanced Go Wrapper is an open source Go database driver wrapper that customers use to connect to Amazon Aurora PostgreSQL clusters.

We identified CVE-2026-126793, an issue in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3). An authenticated database user who can create functions in a schema on another database user's search path might escalate privileges to those of that user, including a member of the rds_superuser role, when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.

Impacted versions: >= 2026-04-06 AND < 2026-07-29 (awssql/v2 >= 2.0.0 AND < 2.0.3)

Resolution:

This issue has been addressed in AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3), released on July 29, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

If you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC (REVOKE CREATE ON SCHEMA public FROM PUBLIC;), and grant CREATE on any other schema in the search_path of database users that connect through AWS Advanced Go Wrapper only to trusted database users.

References:

- CVE-2026-126793
- GHSA-fhr2-6r5v-gm9f

Acknowledgement:

We would like to thank Arpit Jain (arpitjain099) for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any s ecurity questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_