CVE-2026-11400: Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL

Synopsis

An untrusted search path vulnerability in the GlobalDatabasePlugin component of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL allows a remote, low-privileged authenticated attacker to escalate their database privileges to those of any other Amazon RDS user, including rds_superuser. The attack is carried out by the authenticated attacker planting a crafted function in a location the plugin searches at connection time; when a higher-privileged user subsequently connects to the Aurora cluster through the affected wrapper, that function executes under their identity. Successful exploitation gives the attacker full access to data and operations permitted to the targeted user, up to and including superuser-level control. A patched-image rebuild at version 4.0.1 is available on HarborGuard for environments running an affected version of the wrapper.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Aurora cluster and its connection layer over the network; the affected plugin is exercised during remote database connections, so network access to the service is a prerequisite.

• AuthenticationRequired

  Any low-privilege Amazon RDS account is sufficient; the attacker must be able to authenticate to the cluster and create database functions, but no administrative credentials are needed to initiate the attack.

• Victim interactionRequired

  A higher-privileged user must connect to the Aurora cluster through the affected wrapper after the malicious function has been planted, making this a social-engineering or timing-dependent vector that requires another user's action.

• Attack complexityDetail

  The exploit is reliable and condition-free once the crafted function is in place; no race conditions, special memory layout, or unpredictable environmental factors are required to trigger privilege escalation on the victim's next connection.

Blast Radius

• The attacker inherits the full privilege set of the targeted RDS user, including rds_superuser if that user is the victim, allowing unrestricted reads across all database objects and stored data in the Aurora cluster.
• All data in the cluster can be modified or deleted under the escalated identity, including rows, schemas, and configuration objects the original low-privilege account cannot touch.
• The attacker can create, alter, or drop database roles and grant themselves or others persistent elevated access, leaving backdoors that survive after the initial exploitation window closes.
• Availability of the database service can be disrupted by an rds_superuser-level actor terminating connections, dropping critical objects, or exhausting server resources.