Authenticated rds_superuser escalation via unqualified function lookup

Privilege escalation in AWS wrappers for Aurora PostgreSQL allows remote authenticated users to obtain the rds_superuser role. Connection-time SQL uses unqualified PostgreSQL function names, allowing search_path to resolve an attacker-created function in the public schema before the intended pg_catalog function and execute it with another RDS user's permissions. Exploitation requires a low-privilege database account, permission to create the function, and a later connection by a more privileged user through an affected wrapper.