Package vulnerability, severity medium
AWS Advanced Go Wrapper privilege escalation in Aurora PostgreSQL dialect detection (CVE-2026-126793)
Published
AWS Advanced Go Wrapper awssql/v2 versions from 2.0.0 up to but not including 2.0.3 have a flaw in Aurora PostgreSQL dialect detection. An authenticated database user who can create functions in a schema on another user's search path might escalate to that user's privileges, including rds_superuser, when that user connects through the wrapper. The fix is in awssql/v2.0.3, released 2026-07-29.
What's affected
- awssql/v2 (go)>=2.0.0 <2.0.3
What to do
- Upgrade AWS Advanced Go Wrapper to awssql/v2.0.3 or later.
- Patch any forked or derivative code to include the fix.
- If you cannot upgrade immediately, revoke the CREATE privilege on the public schema from PUBLIC.
- Grant CREATE on any other schema in the search_path only to trusted database users that connect through the wrapper.
Check whether you were affected
To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:
/pharon:check-incident aws-advanced-go-wrapper-privilege-escalation-2026-11Don't wait for the next one to reach the news. Pharon tells the team that owns the affected repo within minutes. Free for 7 days, no card.
Get alerted for the next oneReferences
Notice aws-advanced-go-wrapper-privilege-escalation-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.