Untrusted Search Path Vulnerability in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
CVE-2026-11400

8.6HIGH

Key Information:

Vendor

Aws

Status
Aws Advanced Jdbc Wrapper
Vendor
CVE Published:
5 June 2026

What is CVE-2026-11400?

A security flaw in the GlobalDatabasePlugin of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL could allow a remote low-privilege authenticated user to exploit an untrusted search path. This vulnerability enables the manipulation of a crafted function to run with the privileges of another Amazon RDS user, potentially granting unauthorized access to sensitive operations and elevated privileges, including rds_superuser rights. To mitigate this risk, it is crucial for users to upgrade to version 4.0.1 of the AWS Advanced JDBC Wrapper.

Affected Version(s)

AWS Advanced JDBC Wrapper 3.0.0 < 4.0.1

References

https://github.com/aws/aws-advanced-jdbc-wrapper/releases...
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://www.cve.org/cverecord?id=CVE-2026-11400
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.