ByteOS Network

NVD Vulnerability Details :

CVE-2026-11401

Awaiting Analysis

Source-ff89ba41-3aa1-4d27-914a-91399e9639e5

Published At-05 Jun, 2026 | 20:17

Updated At-05 Jun, 2026 | 20:49

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	8.6	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secondary	3.1	8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 4.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Secondary

Version: 3.1

Base score: 8.0

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE ID	Type	Source
CWE-426	Secondary	ff89ba41-3aa1-4d27-914a-91399e9639e5

CWE ID: CWE-426

Type: Secondary

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

References

Hyperlink	Source	Resource
https://aws.amazon.com/security/security-bulletins/2026-039-aws/	ff89ba41-3aa1-4d27-914a-91399e9639e5	N/A
https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26	ff89ba41-3aa1-4d27-914a-91399e9639e5	N/A
https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp	ff89ba41-3aa1-4d27-914a-91399e9639e5	N/A