DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-11400: CVE-2026-11400: Privilege Escalation via Untrusted Search Path in AWS Advanced JDBC Wrapper

#security #cve #cybersecurity

CVE-2026-11400: Privilege Escalation via Untrusted Search Path in AWS Advanced JDBC Wrapper

Vulnerability ID: CVE-2026-11400
CVSS Score: 8.0
Published: 2026-07-17

An untrusted search path vulnerability in the GlobalDatabasePlugin component of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL allows authenticated, low-privilege database users to hijack administrative session queries. By defining a custom function in a writable schema such as the public schema, an attacker can hijack queries executed automatically during driver-level topology detection. When a highly privileged database user connects to the database utilizing an affected version of the wrapper, the custom function executes under their security context, enabling remote privilege escalation to rds_superuser.

TL;DR

A schema-hijacking vulnerability in the AWS Advanced JDBC Wrapper for Aurora PostgreSQL allows authenticated low-privilege users to execute code as rds_superuser when an administrator connects using the affected library, caused by a failure to qualify system function queries.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-426
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.0
  • EPSS Score: 0.00305
  • Exploit Status: poc
  • CISA KEV Status: No

Affected Systems

  • AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
  • AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL: >= 3.0.0, < 4.0.1 (Fixed in: 4.0.1)

Code Analysis

Commit: 01be7ea

Fully qualify topology-probing functions to prevent untrusted search path resolution

@@ -29,18 +29,18 @@
 public class GlobalAuroraPgDialect extends AuroraPgDialect implements GlobalAuroraTopologyDialect {
-  protected static final String GLOBAL_STATUS_FUNC_EXISTS_QUERY = "select 'aurora_global_db_status'::regproc";
+  protected static final String GLOBAL_STATUS_FUNC_EXISTS_QUERY = "select 'pg_catalog.aurora_global_db_status'::regproc";
   protected static final String GLOBAL_INSTANCE_STATUS_FUNC_EXISTS_QUERY =
-      "select 'aurora_global_db_instance_status'::regproc";
+      "select 'pg_catalog.aurora_global_db_instance_status'::regproc";
   protected static final String GLOBAL_TOPOLOGY_QUERY =
       "SELECT SERVER_ID, CASE WHEN SESSION_ID = 'MASTER_SESSION_ID' THEN TRUE ELSE FALSE END, "
           + "VISIBILITY_LAG_IN_MSEC, AWS_REGION "
-          + "FROM aurora_global_db_instance_status()";
+          + "FROM pg_catalog.aurora_global_db_instance_status()";
-  protected static final String REGION_COUNT_QUERY = "SELECT count(1) FROM aurora_global_db_status()";
+  protected static final String REGION_COUNT_QUERY = "SELECT count(1) FROM pg_catalog.aurora_global_db_status()";
   protected static final String REGION_BY_INSTANCE_ID_QUERY =
-      "SELECT AWS_REGION FROM aurora_global_db_instance_status() WHERE SERVER_ID = ?";
+      "SELECT AWS_REGION FROM pg_catalog.aurora_global_db_instance_status() WHERE SERVER_ID = ?";
Enter fullscreen mode Exit fullscreen mode

Commit: a52872f

Handle potential null results gracefully on non-Aurora PostgreSQL connections

@@ -259,17 +259,13 @@ public HostSpec getMonitoringHostSpec() {
-          this.monitoringHostSpec = this.pluginService.identifyConnection(
+          final HostSpec identifiedHostSpec = this.pluginService.identifyConnection(
               this.pluginService.getCurrentConnection(), this.pluginService.getCurrentHostSpec());
-          if (this.monitoringHostSpec == null) {
-            throw new RuntimeException(Messages.get(
-                "HostMonitoringConnectionPlugin.unableToIdentifyConnection",
-                new Object[] {
-                    this.pluginService.getCurrentHostSpec().getHost(),
-                    this.pluginService.getHostListProvider()}));
+          if (identifiedHostSpec != null) {
+            this.monitoringHostSpec = identifiedHostSpec;
+            this.pluginService.setCurrentConnection(this.pluginService.getCurrentConnection(), this.monitoringHostSpec);
           }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the AWS Advanced JDBC Wrapper dependency to version 4.0.1 or later to enforce schema qualification for internal queries.
  • Modify default database permissions to restrict low-privileged write capabilities on public schemas.
  • Enforce explicit, hardened search paths for administrative PostgreSQL roles to prioritize safe system catalogs.

Remediation Steps:

  1. Update your application build definitions (such as Maven or Gradle files) to pull version 4.0.1 of software.amazon.jdbc:aws-advanced-jdbc-wrapper.
  2. For database-level containment, execute REVOKE CREATE ON SCHEMA public FROM PUBLIC; on your Aurora PostgreSQL database instances to prevent unauthorized function registration.
  3. Isolate search paths of administrative accounts by executing ALTER ROLE your_admin_user SET search_path TO pg_catalog;.

References

Read the full report for CVE-2026-11400 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)