CVE-2025-12967 AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Low-privilege users can escalate to rds_superuser via crafted functions in AWS database wrappers, requiring an upgrade to secure versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-12967?
CVE-2025-12967 is a high-severity vulnerability in AWS Go Wrapper, published on 10 Nov 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
Weakness: CWE-470
Which versions are affected by CVE-2025-12967?
3 open source packages ship an affected version, including aws-advanced-python-wrapper and aws_advanced_python_wrapper.
| Package | Affected | Fixed in |
|---|---|---|
aws-advanced-python-wrapper PyPI | All versions | 1.4.0 |
aws-advanced-python-wrapper PyPI | All versions | 1.4.0 |
aws_advanced_python_wrapper PyPI | All versions | 1.4.0 |
How do I fix CVE-2025-12967?
Upgrade aws-advanced-python-wrapper to 1.4.0 or later.
Is CVE-2025-12967 being exploited?
There is no known exploitation of CVE-2025-12967 in the wild and no public exploit code.
Sources
Also known as GHSA-4jvf-wx3f-2x8q, PYSEC-2026-1205.