{"id":"GO-2026-5601","revision":"a97a2f29cb024d4082ce0cd9c291a149","records":[{"revision":"a97a2f29cb024d4082ce0cd9c291a149","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5601","aliases":["CVE-2026-11401","GHSA-r236-5pc3-3qcp"],"title":"AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers","description":"AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/aws/aws-advanced-go-wrapper/xray before 1.07.","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:24.1724813+00:00","affected":[{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/auth-helpers","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/awssql","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/awssql/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/custom-endpoint","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/federated-auth","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/iam","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/mysql-driver","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/okta","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/otlp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/pgx-driver","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/aws/aws-advanced-go-wrapper/xray","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp","https://nvd.nist.gov/vuln/detail/CVE-2026-11401","https://aws.amazon.com/security/security-bulletins/2026-039-aws","https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5601","license":"OSV · upstream source license applies","key":"osv:GO-2026-5601","identifiers":["GO-2026-5601","CVE-2026-11401","GHSA-r236-5pc3-3qcp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}