Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Amazon Neptune allows attacker to run code via graph import

CVE-2026-110812 · published 3 days ago
Summary

If someone with normal database access uses the Gremlin import feature, they could cause the server to run their own code and see internal service passwords. This risk affects Amazon Neptune database engine versions before the latest release. Update to version 1.5.0.0, or apply the back‑ported fixes in 1.4.8.1 or 1.4.7.1, to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
aws amazon neptune engine <= 1.5.0.0
Original advisory text
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-110812 · NVD
CVE-2026-110812 · MITRE
Track software like this
Free during beta