---
id: CVE-2026-11400
title: Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
summary: >-
  An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced
  JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated
  low-privilege actor to escalate privileges to those of another Amazon RDS
  user, in…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-426
vendor: AWS
product: AWS Advanced JDBC Wrapper
affected:
  - advanced_jdbc_wrapper >= 3.0.0 < 4.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-09T14:49:19.874523Z'
published: '2026-06-05'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:12:48.206Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11400'
references:
  - url: 'https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-039-aws/'
  - url: >-
      https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11400'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-039-aws'
  - url: 'https://www.cve.org/cverecord?id=CVE-2026-11400'
  - url: 'https://github.com/advisories/GHSA-mhww-p97m-3368'
tags:
  - cve.org
  - ghsa
  - maven
epss: 0.00496
epssPercentile: 0.42326
aliases:
  - GHSA-mhww-p97m-3368
ecosystem: maven
patched:
  - 'software.amazon.jdbc:aws-advanced-jdbc-wrapper 4.0.1'
ingestedAt: '2026-07-17T19:14:48.474Z'
---

## Overview

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.



To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.

## Affected

- `advanced_jdbc_wrapper >= 3.0.0 < 4.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-11400)

Affected packages:

- `software.amazon.jdbc:aws-advanced-jdbc-wrapper >= 3.0.0, < 4.0.1`

Patched in:

- `software.amazon.jdbc:aws-advanced-jdbc-wrapper 4.0.1`

Source: https://github.com/advisories/GHSA-mhww-p97m-3368