CVE-2025-12967
High · 8.0CVSS
8.0
EPSS
0.8%
Published
Nov 10, 2025
CISA due date
—
The record
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/aws/aws-advanced-go-wrapper/awssql | 0 | 1.1.1 |
| Maven | software.amazon.jdbc:aws-advanced-jdbc-wrapper | 0 | 2.6.5 |
| PyPI | aws-advanced-python-wrapper | 0 | 1.4.0 |
| npm | aws-advanced-nodejs-wrapper | 0 | 2.0.1 |
Related vulnerabilities
- GHSA-4jvf-wx3f-2x8q AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance Same vulnerability
- GHSA-7xw4-g7mm-r4hh Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL… Same vulnerability
- GHSA-8wj8-cfxr-9374 AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance Same vulnerability
- GO-2025-4119 AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in… Also affects github.com/aws/aws-advanced-go-wrapper/awssql
- CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470
- CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. CWE-470
- CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and… CWE-470
- CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for… CWE-470