data/reports/GO-2026-5601.yaml

id: GO-2026-5601
modules:
    - module: github.com/aws/aws-advanced-go-wrapper/auth-helpers
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager
      versions:
        - fixed: 1.1.2
      vulnerable_at: 1.1.2-rc
    - module: github.com/aws/aws-advanced-go-wrapper/awssql
      vulnerable_at: 1.4.0
    - module: github.com/aws/aws-advanced-go-wrapper/awssql/v2
      versions:
        - fixed: 2.0.1
      vulnerable_at: 2.0.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/custom-endpoint
      versions:
        - fixed: 1.0.4
      vulnerable_at: 1.0.4-rc
    - module: github.com/aws/aws-advanced-go-wrapper/federated-auth
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/iam
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/mysql-driver
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/okta
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/otlp
      versions:
        - fixed: 1.0.7
      vulnerable_at: 1.0.6
    - module: github.com/aws/aws-advanced-go-wrapper/pgx-driver
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-rc
    - module: github.com/aws/aws-advanced-go-wrapper/xray
      non_go_versions:
        - fixed: "1.07"
      vulnerable_at: 1.0.7
summary: AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers
cves:
    - CVE-2026-11401
ghsas:
    - GHSA-r236-5pc3-3qcp
references:
    - advisory: https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-r236-5pc3-3qcp
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11401
    - web: https://aws.amazon.com/security/security-bulletins/2026-039-aws
    - web: https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26
source:
    id: GHSA-r236-5pc3-3qcp
    created: 2026-06-25T15:46:22.314030452-04:00
review_status: UNREVIEWED