CVE-2026-11401 — Vulnerability in...

HIGH

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

Published June 11, 2026Updated June 25, 2026Source: osv

Summary

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. An issue in Aurora PostgreSQL using the AWS Go Wrapper waa identified, see CVE-2026-11401. Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: AWS Go Wrapper 2026-04-06 Patches This issue has been addressed in AWS Go Wrapper 2026-05-26. Maintainers recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds Remove the public schema from the search path. References If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Advisory Timeline

First published June 11, 2026 (123 days ago).
Last revised June 25, 2026 — 14 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/aws/aws-advanced-go-wrapper/pgx-driver to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/pgx-driver@v1.1.1

Update github.com/aws/aws-advanced-go-wrapper/okta to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/okta@v1.1.1

Update github.com/aws/aws-advanced-go-wrapper/custom-endpoint to 1.0.4 or later

go get github.com/aws/aws-advanced-go-wrapper/custom-endpoint@v1.0.4

Update github.com/aws/aws-advanced-go-wrapper/iam to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/iam@v1.1.1

Update github.com/aws/aws-advanced-go-wrapper/xray to 1.07 or later

go get github.com/aws/aws-advanced-go-wrapper/xray@v1.07

Update github.com/aws/aws-advanced-go-wrapper/otlp to 1.0.7 or later

go get github.com/aws/aws-advanced-go-wrapper/otlp@v1.0.7

Update github.com/aws/aws-advanced-go-wrapper/auth-helpers to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/auth-helpers@v1.1.1

Update github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager to 1.1.2 or later

go get github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager@v1.1.2

Update github.com/aws/aws-advanced-go-wrapper/federated-auth to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/federated-auth@v1.1.1

Update github.com/aws/aws-advanced-go-wrapper/awssql/v2 to 2.0.1 or later

go get github.com/aws/aws-advanced-go-wrapper/awssql/v2@v2.0.1

Update github.com/aws/aws-advanced-go-wrapper/mysql-driver to 1.1.1 or later

go get github.com/aws/aws-advanced-go-wrapper/mysql-driver@v1.1.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (11)

Affects 1 ecosystem: go (11).

Package	Ecosystem	Affected	Fixed In
github.com/aws/aws-advanced-go-wrapper/pgx-driver	go	All versions	1.1.1
github.com/aws/aws-advanced-go-wrapper/okta	go	All versions	1.1.1
github.com/aws/aws-advanced-go-wrapper/custom-endpoint	go	All versions	1.0.4
github.com/aws/aws-advanced-go-wrapper/iam	go	All versions	1.1.1
github.com/aws/aws-advanced-go-wrapper/xray	go	All versions	1.07
github.com/aws/aws-advanced-go-wrapper/otlp	go	All versions	1.0.7
github.com/aws/aws-advanced-go-wrapper/auth-helpers	go	All versions	1.1.1
github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager	go	All versions	1.1.2
github.com/aws/aws-advanced-go-wrapper/federated-auth	go	All versions	1.1.1
github.com/aws/aws-advanced-go-wrapper/awssql/v2	go	All versions	2.0.1
github.com/aws/aws-advanced-go-wrapper/mysql-driver	go	All versions	1.1.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-426
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.0 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-11401?: AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.0/10).
How do I check if my project is affected by CVE-2026-11401?: CVE-2026-11401 affects github.com/aws/aws-advanced-go-wrapper/pgx-driver, github.com/aws/aws-advanced-go-wrapper/okta and github.com/aws/aws-advanced-go-wrapper/custom-endpoint (and 8 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-11401 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.0

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r236-5pc3-3qcp

GO-2026-5601

Related CVEs

CVE-2026-107809
HIGH
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2026-107813
HIGH
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies