Live › vulnerability › CVE-2026-110812
Go to dashboardAmazon Neptune's Gremlin graph-import path deserializes untrusted input unsafely, a flaw inherited from Apache TinkerPop. An authenticated principal with Neptune query permissions can cause unintended activity inside the query engine environment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Teams running Amazon Neptune engine versions that let identities submit Gremlin queries to the database. Exposure depends on who holds data-plane query permissions, since the flaw needs an authenticated principal. Clusters on patched engine lines or with no untrusted query access can deprioritize the patch only briefly.
>=1.2.0.0No product ranges from the sources yet.
aws neptune describe-db-clusters --query 'DBClusters[].EngineVersion'neptune-db:* or neptune-db:ReadDataViaQuery / neptune-db:WriteDataViaQuery)1.4.7.1, 1.4.8.1 or 1.5.0.0 matching your engine lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-110812 - Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Bulletin ID: 2026-136-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/15/2026 09:30 AM PDT
Description:
Amazon Neptune is a fully managed graph database service. We identified CVE-2026-110812, an issue in Apache TinkerPop related to Gremlin functionality used by Amazon Neptune. Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that causes the query engine to process untrusted input unsafely, which could lead to unintended activity within the query engine environment. This issue has been addressed in the engine versions listed below; we recommend customers upgrade.
Impacted versions: >=1.2.0.0
Resolution:
This issue has been addressed in Amazon Neptune engine versions 1.4.7.1, 1.4.8.1 and 1.5.0.0. We recommend upgrading your Amazon Neptune DB cluster to the corresponding patched version for your engine line. Customers with auto minor version upgrade enabled will receive the update during their next maintenance window; customers who manage engine versions manually should upgrade.
Workarounds:
This issue requires an authenticated principal with data-plane access. Until you can upgrade, follow least-privilege practices and grant Neptune neptune-db (query) permissions only to trusted principals. Upgrading your DB cluster to a patched Neptune engine version is the recommended remediation.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-110812")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.