GHSA-7xw4-g7mm-r4hh Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Q: Which versions are affected by GHSA-7xw4-g7mm-r4hh?

2 open source packages ship an affected version, including software.amazon.jdbc:aws-advanced-jdbc-wrapper.

Q: Is GHSA-7xw4-g7mm-r4hh being exploited?

There is no known exploitation of GHSA-7xw4-g7mm-r4hh in the wild and no public exploit code.

Q: How do I fix GHSA-7xw4-g7mm-r4hh?

Upgrade software.amazon.jdbc:aws-advanced-jdbc-wrapper to 2.6.5 or later.

Not scored Published 13 Nov 2025

A low-privilege user can escalate privileges to rds_superuser in Aurora PostgreSQL via a crafted function in the AWS JDBC Wrapper.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-7xw4-g7mm-r4hh?

GHSA-7xw4-g7mm-r4hh is a vulnerability in software.amazon.jdbc:aws-advanced-jdbc-wrapper, published on 13 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Description of Vulnerability:

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

AWS recommends for customers to upgrade to the following versions: AWS JDBC Wrapper to v2.6.5 or greater.

Source of Vulnerability Report:

Allistair Ishmael Hakim [email protected]

Affected products & versions:

AWS JDBC Wrapper < 2.6.5

Platforms:

MacOS/Windows/Linux

Which versions are affected by GHSA-7xw4-g7mm-r4hh?