Privilege Escalation Vulnerability in AWS Advanced Go Wrapper for Aurora PostgreSQL
CVE-2026-126793

8.6HIGH

Key Information:

Vendor

Aws

Status
Aws-advanced-go-wrapper
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126793?

A vulnerability exists within the AWS Advanced Go Wrapper that allows untrusted search path manipulation during Aurora PostgreSQL dialect detection. An authenticated remote user can exploit this issue to gain elevated privileges, potentially including access to the rds_superuser role. This can occur through a specially crafted function that triggers upon connection to an affected Aurora PostgreSQL cluster. To mitigate this risk, users are advised to update to version 2026-07-29 (awssql/v2.0.3) or later.

Affected Version(s)

aws-advanced-go-wrapper 2026-04-06 < 2026-07-29

References

https://github.com/aws/aws-advanced-go-wrapper/releases/t...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/aws/aws-advanced-go-wrapper/security/a...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.