CVE-2026-11400 Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
A low-privilege user can escalate privileges to rds_superuser via a crafted function in the AWS Advanced JDBC Wrapper for Aurora PostgreSQL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-11400?
CVE-2026-11400 is a high-severity vulnerability in AWS Advanced JDBC Wrapper, published on 5 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.
To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.
Weakness: CWE-426
Which versions are affected by CVE-2026-11400?
2 open source packages ship an affected version, including software.amazon.jdbc:aws-advanced-jdbc-wrapper.
| Package | Affected | Fixed in |
|---|---|---|
software.amazon.jdbc:aws-advanced-jdbc-wrapper Maven | From 3.0.0 | 4.0.1 |
software.amazon.jdbc:aws-advanced-jdbc-wrapper Maven | From 3.0.0 | 4.0.1 |
How do I fix CVE-2026-11400?
Upgrade software.amazon.jdbc:aws-advanced-jdbc-wrapper to 4.0.1 or later.
Is CVE-2026-11400 being exploited?
There is no known exploitation of CVE-2026-11400 in the wild and no public exploit code.
Sources
Also known as GHSA-mhww-p97m-3368.