Cpe:2.3:a:amazon:aws_advanced_go_wrapper:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aamazonaws_advanced_go_wrapper/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:52:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAmazon AWS Advanced Go Wrapper: Untrusted search path in Aurora PostgreSQL dialect detection (CVE-2026-126793)https://feed.craftedsignal.io/briefs/2026-11-aws-go-wrapper-vuln-cve-2026-126793/Thu, 12 Nov 2026 22:52:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-aws-go-wrapper-vuln-cve-2026-126793/The AWS Advanced Go Wrapper contains an untrusted search path vulnerability during Aurora PostgreSQL dialect detection that allows an authenticated remote user to escalate privileges to rds_superuser.The AWS Advanced Go Wrapper (awssql) contains an untrusted search path vulnerability during Aurora PostgreSQL dialect detection. The flaw exists in versions from 2026-04-06 (awssql/v2.0.0) up to, but not including, 2026-07-29 (awssql/v2.0.3). An authenticated remote user can exploit this issue to escalate privileges to those of another database user, including a member of the rds_superuser role. The exploitation occurs via a crafted function that executes when the target user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.

Impact

Successful exploitation allows an authenticated remote attacker to escalate privileges to the level of the target user, specifically enabling unauthorized access to the rds_superuser role within an Aurora PostgreSQL cluster.

Recommendation

Upgrade all instances of the AWS Advanced Go Wrapper to release 2026-07-29 (awssql/v2.0.3) or later to remediate CVE-2026-126793.

]]>highadvisory