Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

published 2025-11-13 last yr. modified 2026-02-04 9mo ago

cvss: 8.0; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Description of Vulnerability: An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

AWS recommends for customers to upgrade to the following versions: AWS JDBC Wrapper to v2.6.5 or greater.

### Source of Vulnerability Report: Allistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)

### Affected products & versions: AWS JDBC Wrapper < 2.6.5

### Platforms: MacOS/Windows/Linux

Patch / fix

fixed in 1 links 2

maven software.amazon.jdbc:aws-advanced-jdbc-wrapper 2.6.5

Is GHSA-7xw4-g7mm-r4hh in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	software.amazon.jdbc:aws-advanced-jdbc-wrapper	<2.6.5	2.6.5

Classification

Weakness

CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

GitHub Advisory GHSA-7xw4-g7mm-r4hh

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.