CVE-2026-126793

Description

An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.0CVSS 3.1, Highfrom the CNA (AMZN)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
• 8.6CVSS 4.0, Highfrom the CNA (AMZN)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-233 Privilege Escalation (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 12 Nov 2026 Published

Weakness

• CWE-426

References

• github.comrelease-notespatch
• aws.amazon.comvendor-advisory
• github.comthird-party-advisory