GHSA-7wq2-32h4-9hc9
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance
GHSA-7wq2-32h4-9hc9 is a high vulnerability (CVSS 8.0) in github.com/aws/aws-advanced-go-wrapper/awssql, published November 13, 2025. No source lists public exploit code. Fixed in github.com/aws/aws-advanced-go-wrapper/awssql 1.1.1.
- Severity
- 8.0 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
Description
Description of Vulnerability:
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
We recommend customers upgrade to the following versions: AWS Go Wrapper to 2025-10-17
Source of Vulnerability Report:
Allistair Ishmael Hakim allistair.hakim@gmail.com
Affected products & versions:
AWS Go Wrapper < 2025-10-17
Platforms:
MacOS/Windows/Linux
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/aws/aws-advanced-go-wrapper/awssqlGo | before 1.1.1 | 1.1.1 |
github.com/aws/aws-advanced-go-wrapper/auth-helpersGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/aws-secrets-managerGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/federated-authGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/iamGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/mysql-driverGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/oktaGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/otlpGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/pgx-driverGo | before 1.0.2 | 1.0.2 |
github.com/aws/aws-advanced-go-wrapper/xrayGo | before 1.0.2 | 1.0.2 |
What each source reports
GitHub Advisories Score used
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance
Description of Vulnerability:
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
We recommend customers upgrade to the following versions: AWS Go Wrapper to 2025-10-17
Source of Vulnerability Report:
Allistair Ishmael Hakim allistair.hakim@gmail.com
Affected products & versions:
AWS Go Wrapper < 2025-10-17
Platforms:
MacOS/Windows/Linux
- Record
GHSA-7wq2-32h4-9hc9- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
OSV
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance
Description of Vulnerability:
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
We recommend customers upgrade to the following versions: AWS Go Wrapper to 2025-10-17
Source of Vulnerability Report:
Allistair Ishmael Hakim allistair.hakim@gmail.com
Affected products & versions:
AWS Go Wrapper < 2025-10-17
Platforms:
MacOS/Windows/Linux
- Record
GHSA-7wq2-32h4-9hc9- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
OSVGO-2025-4119No score
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql
- Record
GO-2025-4119- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.