AWS Advanced Go Wrapper Fixes Aurora PostgreSQL Privilege Escalation
Tech GuruQuick Answer
Update the wrapper and affected companion modules. Restrict schema CREATE privileges to trusted users on search paths used by connecting accounts.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory application Go module versions, Aurora PostgreSQL connection roles, schema ownership, CREATE grants and search_path settings. Match the installed library and stated access/configuration prerequisites; AWS service use alone does not establish exposure. AWS Advanced Go Wrapper release 2026-07-29, including awssql/v2 2.0.3; use the repository advisory for companion-module fixed versions. Apply the corresponding fix to forks and derivative deployments. Verify deployed module versions and connection behavior; review unexpected functions and grants, and retain module manifests and database audit evidence.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS Advanced Go Wrapper Aurora PostgreSQL dialect detection |
|---|---|
| Advisory | GHSA-fhr2-6r5v-gm9f / 2026-182-AWS |
| CVE | CVE-2026-126793 |
| Authoritative release date | 2026-11-12 — 2026-11-12 21:07:17 UTC (AWS repository advisory). |
| Authority revision date | 2026-11-12 21:10:26 UTC |
| Affected versions | Wrapper releases from 2026-04-06 before 2026-07-29, including awssql/v2 >=2.0.0 and <2.0.3. Exploitation requires an authenticated database user able to create objects in another connecting user’s search path. |
| Fixed version | AWS Advanced Go Wrapper release 2026-07-29, including awssql/v2 2.0.3; use the repository advisory for companion-module fixed versions |
| CVSS base score | 8.0 (CVSS v3.1 base score) |
| CVSS severity | High |
| Exploitation status | AWS does not confirm exploitation in the wild in the cited advisories.; no exploitation claim is inferred. |
What Changed
Untrusted search-path objects can run during dialect detection with the connecting user’s privileges, potentially including rds_superuser membership.
What To Validate Now
- Inventory. Inventory application Go module versions, Aurora PostgreSQL connection roles, schema ownership, CREATE grants and search_path settings.
- Establish applicability. Match the installed library and stated access/configuration prerequisites; AWS service use alone does not establish exposure.
- Remediate. AWS Advanced Go Wrapper release 2026-07-29, including awssql/v2 2.0.3; use the repository advisory for companion-module fixed versions. Apply the corresponding fix to forks and derivative deployments.
- Validate. Verify deployed module versions and connection behavior; review unexpected functions and grants, and retain module manifests and database audit evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The fix shipped July 29; the security advisory was disclosed November 12. Test schema permission changes against legitimate application migrations.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
