Amazon AWS Advanced Go Wrapper: Untrusted search path in Aurora PostgreSQL dialect detection (CVE-2026-126793)
The AWS Advanced Go Wrapper contains an untrusted search path vulnerability during Aurora PostgreSQL dialect detection that allows an authenticated remote user to escalate privileges to rds_superuser.
CVE search metadata
CVE search record: CVE-2026-126793. Severity: high. CVSS: 8.0. KEV: no. Product: AWS Advanced Go Wrapper (awssql/v2.0.0 to < v2.0.3). Brief: Amazon AWS Advanced Go Wrapper: Untrusted search path in Aurora PostgreSQL dialect detection (CVE-2026-126793). Brief link: https://feed.craftedsignal.io/briefs/2026-11-aws-go-wrapper-vuln-cve-2026-126793/
Triage facts
Revision 1- Applicability
- AWS Advanced Go Wrapper (awssql/v2.0.0 to < v2.0.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 22:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
The AWS Advanced Go Wrapper (awssql) contains an untrusted search path vulnerability during Aurora PostgreSQL dialect detection. The flaw exists in versions from 2026-04-06 (awssql/v2.0.0) up to, but not including, 2026-07-29 (awssql/v2.0.3). An authenticated remote user can exploit this issue to escalate privileges to those of another database user, including a member of the rds_superuser role. The exploitation occurs via a crafted function that executes when the target user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.
Impact
Successful exploitation allows an authenticated remote attacker to escalate privileges to the level of the target user, specifically enabling unauthorized access to the rds_superuser role within an Aurora PostgreSQL cluster.
Recommendation
Upgrade all instances of the AWS Advanced Go Wrapper to release 2026-07-29 (awssql/v2.0.3) or later to remediate CVE-2026-126793.
Threat Hunt
Identify connections to Aurora PostgreSQL clusters originating from applications using awssql v2.0.0 through v2.0.2, followed by subsequent high-privilege administrative actions or unusual function execution by low-privileged database users.
Data: Database connection logs, Database audit logs, Application dependency manifests
Mitigations
Upgrade AWS Advanced Go Wrapper to version 2026-07-29 (awssql/v2.0.3) or later
CVE-2026-126793
Gaps
- No specific telemetry or detection logic exists for this library-level vulnerability; rely on asset inventory and patch management.