CVE-2026-11400

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper. To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-039-aws/
https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Un problema de ruta de búsqueda no confiable en el GlobalDatabasePlugin del AWS Advanced JDBC Wrapper para Amazon Aurora PostgreSQL permitirá a un actor remoto autenticado con privilegios bajos escalar privilegios a los de otro usuario de Amazon RDS, incluyendo rds_superuser, a través de una función manipulada creada por el actor que se ejecuta cuando ese usuario se conecta al clúster a través de un wrapper afectado. Para remediar este problema, los usuarios deben actualizar a la versión 4.0.1 del AWS Advanced JDBC Wrapper.

20 Oct 2026, 19:17

Type	Values Removed	Values Added
References	~~{'url': 'https://www.cve.org/cverecord?id=CVE-2026-11400', 'source': 'ff89ba41-3aa1-4d27-914a-91399e9639e5'}~~	() https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368 -

Information

Published : 2026-06-05 20:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-11400

Mitre link : CVE-2026-11400

CVE.ORG link : CVE-2026-11400

JSON object : View

Products Affected

No product.

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-11400", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11400", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T14:49:19.874523Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "AWS Advanced JDBC Wrapper", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "4.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-05T20:17:28.733", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-039-aws/", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-mhww-p97m-3368", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.\n\n\n\nTo remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1."}, {"lang": "es", "value": "Un problema de ruta de b\u00fasqueda no confiable en el GlobalDatabasePlugin del AWS Advanced JDBC Wrapper para Amazon Aurora PostgreSQL permitir\u00e1 a un actor remoto autenticado con privilegios bajos escalar privilegios a los de otro usuario de Amazon RDS, incluyendo rds_superuser, a trav\u00e9s de una funci\u00f3n manipulada creada por el actor que se ejecuta cuando ese usuario se conecta al cl\u00faster a trav\u00e9s de un wrapper afectado.\n\nPara remediar este problema, los usuarios deben actualizar a la versi\u00f3n 4.0.1 del AWS Advanced JDBC Wrapper."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}