AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL.
The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper
Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
Impacted versions: AWS Advanced JDBC Wrapper >= 3.0.0 and < 4.0.1
Patches This issue has been addressed in AWS JDBC Wrapper v4.0.1. It is recommended to upgrade to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds Remove the public schema from the search path.
Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
AWS-JDBC Wrapper would like to thank x.com/ph0smet for collaborating on this issue through the coordinated vulnerability disclosure process.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | software.amazon.jdbc:aws-advanced-jdbc-wrapper | >= 3.0.0, < 4.0.1 | 4.0.1 |
Referencias
- https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368
- https://nvd.nist.gov/vuln/detail/CVE-2026-11400
- https://aws.amazon.com/security/security-bulletins/2026-039-aws
- https://github.com/aws/aws-advanced-jdbc-wrapper
- https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
- https://www.cve.org/cverecord?id=CVE-2026-11400
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-426- Plataforma
- Java / Kotlin (Maven)
- Paquete
software.amazon.jdbc:aws-advanced-jdbc-wrapper- Publicada
- 17.07.2026
- Actualizado
- 11.10.2026 12:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-mhww-p97m-3368 - CC BY 4.0
Historial de vulnerabilidades: software.amazon.jdbc:aws-advanced-jdbc-wrapper
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 11.2025 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
Divulgaciones por año
- 2025: 1
- 2026: 1
-
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.