Quick answers
- Is CVE-2026-126793 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126793 being exploited in the wild.
- How severe is CVE-2026-126793?
- High severity, with a CVSS score of 8, published 12 November 2026.
- Which products and versions are affected?
- Amazon Advanced Go Wrapper 2.0.0 through 2.0.2.
- Is there a fix for CVE-2026-126793?
- Yes: fixed in AWS Advanced Go Wrapper 2.0.3. Until then: Revoke CREATE privilege on the public schema from PUBLIC using 'REVOKE CREATE ON SCHEMA public FROM PUBLIC;' and grant CREATE on other schemas in the search_path only to trusted database users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126793 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-126793?
- Check whether you run Amazon Advanced Go Wrapper or Amazon AWS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: AWS Advanced Go Wrapper 2.0.3
Revoke CREATE privilege on the public schema from PUBLIC using 'REVOKE CREATE ON SCHEMA public FROM PUBLIC;' and grant CREATE on other schemas in the search_path only to trusted database users.
Technical details
An untrusted search path vulnerability in Aurora PostgreSQL dialect detection allows a malicious function to be executed with the privileges of the connecting user. An authenticated attacker who can create functions in a schema on the search path of another database user can trigger privilege escalation when that target user connects to the Aurora cluster via the affected wrapper. The vulnerability is a search path injection issue tied to the wrapper's dialect detection mechanism.
Affected products
- Amazon Advanced Go Wrapper 2.0.0 through 2.0.2
Timeline
- 2026-11-12: disclosed