A high-severity privilege escalation vulnerability, identified as CVE-2026-11400 with a CVSS score of 8.6, affects the Aurora PostgreSQL instance by allowing a low-privilege authenticated user to create a crafted function that can be executed with permissions of other Amazon Relational Database Service (RDS) users. This flaw type is an improper access control vulnerability, which can be exploited through network attacks via a network vector. The business impact of this issue is significant, as it enables unauthorized privilege escalation to the rds_superuser role, potentially leading to data breaches and unauthorized modifications to database configurations. The affected version range includes AWS Advanced JDBC Wrapper versions 3.0.0 and later up to but not including 4.0.1.
We recommend you to update AWS Advanced JDBC Wrapper to version 4.0.1.[/subscribe_to_unlock_form]
A high-severity privilege escalation vulnerability, identified as CVE-2026-11400 with a CVSS score of 8.6, affects the Aurora PostgreSQL instance by allowing a low-privilege authenticated user to create a crafted function that can be executed with permissions of other Amazon Relational Database Service (RDS) users. This flaw type is an improper access control vulnerability, which can be exploited through network attacks via a network vector. The business impact of this issue is significant, as it enables unauthorized privilege escalation to the rds_superuser role, potentially leading to data breaches and unauthorized modifications to database configurations. The affected version range includes AWS Advanced JDBC Wrapper versions 3.0.0 and later up to but not including 4.0.1.
We recommend you to update AWS Advanced JDBC Wrapper to version 4.0.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]