CVE-2026-126793
Last modified
CVE-2026-126793 is a high-severity vulnerability rated 8/10 on the CVSS scale. An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later..
Description
An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AWS | aws-advanced-go-wrapper | >= 2026-04-06, < 2026-07-29 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-126793?
How severe is CVE-2026-126793?
How do I fix CVE-2026-126793?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126778Wallos 4.4.0 before 5.10.3 contains a stored cross-site scri…5.4
- CVE-2026-126779Spatie Browsershot 2.2.0 before 5.5.0 contains a local file …7.5
- CVE-2026-126780Webmin through 2.670 contains a privilege escalation vulnera…7.2
- CVE-2026-126781Webmin through 2.670 contains a users file injection vulnera…7.5
- CVE-2026-126784Missing rate limiting, per-account submission quota and geog…4.3
- CVE-2026-126785A vulnerability has been found in rmalright TR-VISION HOME 2…8.8
- CVE-2026-126795A vulnerability was determined in ToolJet up to 3.20.256-lts…7.3
- CVE-2026-126797NextScan 1.1.0 through 1.2.0 contains an authentication bypa…9.8
- CVE-2026-126798NextScan 1.1.0 through 1.2.0 contains a stored cross-site sc…4.7
- CVE-2026-126799Gotenberg 8.31.0 before 8.38.0 contains a server-side reques…7.5
- CVE-2026-1268The Dynamic Widget Content plugin for WordPress is vulnerabl…6.4
- CVE-2026-126800Hydro @hydrooj/ui-default before 4.59.1 contains a stored cr…8.7
Are you affected by CVE-2026-126793?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST