CVE-2026-11401: Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

Synopsis

A privilege escalation vulnerability exists in the GlobalDatabasePlugin component of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. The flaw is reachable over the network and requires a low-privilege authenticated account; no admin access is needed. A successful attacker can hijack the session of another Amazon RDS user, including one with rds_superuser rights, by planting a crafted function that executes when that user connects through the affected wrapper. A patched-image rebuild at fix version 2026-05-26 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Aurora PostgreSQL cluster endpoint over the network through the affected wrapper to deliver the crafted function.

• AuthenticationRequired

  A valid low-privilege Amazon RDS account is sufficient; no administrative credentials are needed.

• Victim interactionRequired

  A higher-privilege user (including a potential rds_superuser) must connect to the cluster through the affected wrapper, triggering the attacker's planted function.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors are required.

Blast Radius

• The attacker gains the full privileges of the targeted RDS user, including rds_superuser rights if that user is the victim.
• With superuser-equivalent access, the attacker can read any database object, including stored credentials, application data, and secrets held in the Aurora PostgreSQL cluster.
• The attacker can modify or delete persisted database rows, schemas, and configuration, corrupting application state or destroying data.
• Service availability can be disrupted by dropping tables, terminating backend connections, or exhausting cluster resources under the escalated role.