AWS Patches Critical Amazon Neptune Vulnerability in Apache TinkerPop Gremlin
Do Son 
TL;DR
Amazon Web Services (AWS) published security bulletin 2026-136-AWS on October 15, 2026, addressing a critical Amazon Neptune vulnerability. Tracked as CVE-2026-110812 (CVSS 9.9), the flaw involves unsafe deserialization of untrusted data in Apache TinkerPop Gremlin. Consequently, database administrators should upgrade their Neptune DB clusters immediately.
- CVE: CVE-2026-110812
- CVSS: 9.9 (Critical · CVSSv3)
- Product: AWS Amazon Neptune Engine
- Affected: 1.2.0.0
- Impact: Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
- Status: No confirmed exploitation yet
- Patched in: 1.5.0.0, 1.4.7.1, 1.4.8.1
- Action: Update to 1.5.0.0, 1.4.7.1, 1.4.8.1 now
Why It Matters
As the vendor notes, “Amazon Neptune is a fully managed graph database service.” While exact global deployment counts are not specified in the advisory, many enterprises rely on Neptune to process connected data sets. A critical flaw in the query engine puts cloud database environments at severe risk. Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.
How the Attack Works
According to the security bulletin, the flaw stems from an issue in Apache TinkerPop related to Gremlin graph-import path functionality. Specifically, the service fails to safely deserialize untrusted data.
Query Engine Exploitation
In its advisory, AWS explains that “Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that causes the query engine to process untrusted input unsafely, which could lead to unintended activity within the query engine environment.” Therefore, an attacker who already holds valid query credentials can send a crafted request to compromise the underlying query engine.
Affected Versions
This Amazon Neptune vulnerability affects all engine versions greater than or equal to 1.2.0.0 prior to the patched releases. Patched versions 1.4.7.1, 1.4.8.1, and 1.5.0.0 are not affected.
Patch and Mitigation Steps
Regarding fixes, the advisory states that “This issue has been addressed in Amazon Neptune engine versions 1.4.7.1, 1.4.8.1 and 1.5.0.0.” Furthermore, AWS notes that “Customers with auto minor version upgrade enabled will receive the update during their next maintenance window; customers who manage engine versions manually should upgrade.”
For temporary protection, AWS advises that “Until you can upgrade, follow least-privilege practices and grant Neptune neptune-db (query) permissions only to trusted principals.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
