# AWS Advanced Go Wrapper: database object creation can enable privilege escalation Canonical: https://www.oktsec.com/radar/aws-advanced-go-wrapper-cve-2026-126793 Publisher: Oktsec Language: en Published: 2026-11-14T14:21:38Z Updated: 2026-11-14T14:21:38Z Record reviewed: 2026-11-14T14:21:38Z Latest evidence check: 2026-11-14T14:21:38Z Disclosed: 2026-11-12 An authenticated database user can exploit an untrusted schema in another user’s search path when that user connects through an affected wrapper. AWS disclosed the issue in November; the correction was released on July 29. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: AWS confirms a correction and an authenticated database prerequisite. The reviewed notices do not report attacks; November disclosure does not mean a new November compromise. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Account access required - Vendor: AWS - Products: AWS Advanced Go Wrapper - CVEs: CVE-2026-126793 ## Technical overview The wrapper’s Aurora PostgreSQL detection can resolve a function through an untrusted schema. The attacker already needs database access and the ability to create objects on a different user’s search path. When that user connects through the affected wrapper, the attacker may obtain that user’s database privileges, potentially including rds_superuser membership. The maintainer describes this as an incomplete earlier correction. The relevant fix is the July 29 wrapper release, not an unverified future service patch. The November 12 bulletin asks customers to update forks and derivative code as well. This is not a claim that Aurora customers were compromised or that an unauthenticated Internet user can exploit every database. ## Recommended response Update awssql/v2 to 2.0.3 or later and review companion module versions. Until corrected, restrict schema CREATE privileges to trusted database users. Relevant to: Go application teams connecting to Aurora PostgreSQL through AWS Advanced Go Wrapper. ## CVE attribution - CVE-2026-126793: AWS — AWS Advanced Go Wrapper. [Source](https://aws.amazon.com/security/security-bulletins/2026-182-aws/) ## Affected systems and fixes ### awssql/v2 and Aurora PostgreSQL dialect detection Affected: 2.0.0 through 2.0.2; wrapper releases from April 6 through before July 29, 2026. Requires object creation in a schema on another connecting user’s search_path. Fixed release / action: 2.0.3 / wrapper release 2026-07-29 ### Companion modules Affected: Check each installed module against the package ranges in the maintainer advisory. Fixed release / action: auth-helpers, federated-auth, iam, mysql-driver, okta and pgx-driver: 1.1.3; aws-secrets-manager: 1.1.4; custom-endpoint: 1.0.6; otlp and xray: 1.0.9 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-126793](https://api.first.org/data/v1/epss?cve=CVE-2026-126793): 0.32% probability of observed exploitation in the next 30 days; percentile 24.8%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ### Official regional advisories - [Vulnerabilidad en productos AWS](https://www.cert.gov.py/vulnerabilidad-en-productos-aws-2/) — CERT-PY, Paraguay; publication 2026-11-13T11:49:07.000Z; observed 2026-11-14T21:07:37.491Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Inspect application dependencies** — Check awssql/v2 and companion modules, including forks and derivative code. 2. **Deploy the corrected wrapper** — Upgrade affected modules and rebuild the application. Confirm the running application includes the corrected dependencies. 3. **Limit schema creation** — Until upgrading, follow AWS guidance to restrict CREATE on public and other schemas in connecting users’ search_path to trusted users. 4. **Check unexpected functions and grants** — Oktsec recommends reviewing suspicious schema objects and changes to database privileges when exposure conditions were present. ## Relevance to AI environments Review the database roles used by automation and who can create objects on their search paths. ## Sources - [AWS bulletin: prerequisites, July correction and workaround](https://aws.amazon.com/security/security-bulletins/2026-182-aws/) — AWS; Vendor notice; checked 2026-11-14T14:21:38Z - [Maintainer advisory: affected modules and corrected versions](https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-fhr2-6r5v-gm9f) — AWS maintainers; Vendor notice; checked 2026-11-14T14:21:38Z ## Editorial record - 2026-11-14T14:21:38Z: Added verified scope, correction and evidence limits from primary sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/aws-advanced-go-wrapper-cve-2026-126793) · [Build a response plan](https://www.oktsec.com/radar/aws-advanced-go-wrapper-cve-2026-126793#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=aws-advanced-go-wrapper-cve-2026-126793&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=aws-advanced-go-wrapper-cve-2026-126793&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.