CVE-2026-11400 json
Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
published 5mo ago modified 14d ago also GHSA-mhww-p97m-3368 , EUVD-2026-34900
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.
To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.
Patch / fix
- maven software.amazon.jdbc:aws-advanced-jdbc-wrapper 4.0.1
- AWS AWS Advanced JDBC Wrapper 4.0.1
Is CVE-2026-11400 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | software.amazon.jdbc:aws-advanced-jdbc-wrapper | >=3.0.0, <4.0.1 |
4.0.1 |
Affected products
- AWS AWS Advanced JDBC Wrapper
Classification
- Weakness
-
- CWE-426 Untrusted Search Path
References
-
github.com
/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
patch, web
-
aws.amazon.com
/security/security-bulletins/2026-039-aws/
vendor-advisory
-
github.com
/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-11400
advisory
-
aws.amazon.com
/security/security-bulletins/2026-039-aws
web
-
github.com
/aws/aws-advanced-jdbc-wrapper
package
-
cve.org
/cverecord?id=CVE-2026-11400
web
Sources
- CVE List CVE-2026-11400
- GitHub Advisory GHSA-mhww-p97m-3368
- NVD CVE-2026-11400
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.