CVE-2026-11400

Name of the Vulnerable Software and Affected Versions AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL versions prior to 4.0.1

Description An untrusted search path issue exists in the GlobalDatabasePlugin. This allows a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds superuser. The attack is performed via a crafted function created by the actor that executes when the target user connects to the cluster through an affected wrapper.

Recommendations Upgrade to AWS Advanced JDBC Wrapper version 4.0.1.