CVE-2026-11401: AWS Advanced Go Wrapper privilege escalation in GlobalDatabasePlugin

CVE-2026-11401 · Severity: high · CVSS 8 · Published 2026-06-05

The AWS Advanced Go Wrapper is a library used to connect applications to Amazon Aurora PostgreSQL databases. A security vulnerability has been identified that allows a user with low-level database access to trick other users, including administrators, into running malicious code. This could lead to a full takeover of the database instance, unauthorized data access, or service disruption.

Technologies: github.com/aws/aws-advanced-go-wrapper/awssql (Go). Vendors: AWS, Go.

Quick answers

Is CVE-2026-11401 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11401 being exploited in the wild.
How severe is CVE-2026-11401?
High severity, with a CVSS score of 8, published 5 June 2026.
Which products and versions are affected?
AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL release 2026-04-06; github.com/aws/aws-advanced-go-wrapper/auth-helpers (Go) <= 1.1.0, SEMVER:introduced=0,fixed=1.1.1; github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager (Go) <= 1.1.1, SEMVER:introduced=0,fixed=1.1.2; github.com/aws/aws-advanced-go-wrapper/awssql (Go) SEMVER:introduced=0; and 9 more.
Is there a fix for CVE-2026-11401?
Yes. github.com/aws/aws-advanced-go-wrapper/auth-helpers (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager (Go): upgrade to 1.1.2 or later; github.com/aws/aws-advanced-go-wrapper/awssql/v2 (Go): upgrade to 2.0.1 or later; github.com/aws/aws-advanced-go-wrapper/custom-endpoint (Go): upgrade to 1.0.4 or later; github.com/aws/aws-advanced-go-wrapper/federated-auth (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/iam (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/mysql-driver (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/okta (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/otlp (Go): upgrade to 1.0.7 or later; github.com/aws/aws-advanced-go-wrapper/pgx-driver (Go): upgrade to 1.1.1 or later; github.com/aws/aws-advanced-go-wrapper/xray (Go): upgrade to 1.07 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11401 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-11401?
Check whether you run AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL, github.com/aws/aws-advanced-go-wrapper/auth-helpers (Go), github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/aws/aws-advanced-go-wrapper/auth-helpers (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/auth-helpers@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager (Go): upgrade to 1.1.2 or later
    go get github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager@v1.1.2
  • github.com/aws/aws-advanced-go-wrapper/awssql/v2 (Go): upgrade to 2.0.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/awssql/v2@v2.0.1
  • github.com/aws/aws-advanced-go-wrapper/custom-endpoint (Go): upgrade to 1.0.4 or later
    go get github.com/aws/aws-advanced-go-wrapper/custom-endpoint@v1.0.4
  • github.com/aws/aws-advanced-go-wrapper/federated-auth (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/federated-auth@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/iam (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/iam@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/mysql-driver (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/mysql-driver@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/okta (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/okta@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/otlp (Go): upgrade to 1.0.7 or later
    go get github.com/aws/aws-advanced-go-wrapper/otlp@v1.0.7
  • github.com/aws/aws-advanced-go-wrapper/pgx-driver (Go): upgrade to 1.1.1 or later
    go get github.com/aws/aws-advanced-go-wrapper/pgx-driver@v1.1.1
  • github.com/aws/aws-advanced-go-wrapper/xray (Go): upgrade to 1.07 or later
    go get github.com/aws/aws-advanced-go-wrapper/xray@v1.07

Technical details

An untrusted search path vulnerability (CWE-426) exists in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. A remote authenticated attacker with low privileges can exploit this by creating a specially crafted database function. When a higher-privileged user (such as an rds_superuser) connects to the cluster through the affected wrapper, the malicious function may be executed with that user's permissions. This allows the attacker to escalate privileges and gain full control over the RDS instance. The issue is resolved in the 2026-05-26 release (v1.1.1 and related sub-module updates).

Affected products

  • AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL <= 1.1.0 (or release 2026-04-06)

Identifiers

  • CVE-2026-11401
  • GHSA-r236-5pc3-3qcp
  • GO-2026-5601

Timeline

  • 2026-05-20: disclosed: Initial GitHub advisory publication
  • 2026-05-26: patched: Release 2026-05-26 published
  • 2026-06-05: advisory: AWS Security Bulletin and NVD publication
  • 2026-06-11: other: GitHub Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.