Amazon Neptune Fixes Critical Graph Import Flaw in Engine Updates
AWS releases patches for CVE-2026-110812, a deserialization issue in the Gremlin import path that could allow unintended activity in the query engine.
Key points
- AWS published bulletin 2026-136-AWS on October 15, 2026, addressing CVE-2026-110812.
- The flaw exists in the Gremlin graph-import path within Apache TinkerPop components.
- Patched versions 1.4.7.1, 1.4.8.1, and 1.5.0.0 are now available for affected clusters.
Amazon Web Services released security bulletin 2026-136-AWS on October 15, 2026, to address CVE-2026-110812. The update resolves a deserialization vulnerability in the Gremlin graph-import path of the Amazon Neptune engine. AWS classified the bulletin content as important, requiring customer attention.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-110812
The National Vulnerability Database records the issue with a CVSS score of 9.9. The flaw stems from weaknesses CWE-502 and CWE-918 in the Apache TinkerPop components used by Neptune. The NVD description notes that an authenticated remote actor with standard database permissions might execute arbitrary code and access internal service credentials. AWS describes the impact as potentially leading to unintended activity within the query engine environment.
Context and Background
AWS stated that the issue relates to Gremlin functionality used by Amazon Neptune. Under specific conditions, an authenticated principal holding Neptune data-plane permissions could submit a request. This request causes the query engine to process untrusted input unsafely. The company identified the problem in Apache TinkerPop, which underpins the Gremlin query language support in the service.
The NVD record specifies that the weakness allows for the deserialization of untrusted data. This type of flaw often results in remote code execution or data exposure. AWS emphasized that the issue is contained within the query engine environment. The bulletin advises that the fix has been addressed in specific engine versions released to customers.
Who Is Affected
Amazon Neptune engine versions 1.2.0.0 and later are impacted by this vulnerability. Customers running these versions should verify their current cluster status. The NVD record lists versions up to 1.5.0.0 as affected. AWS recommends upgrading to the corresponding patched version for each engine line. Auto minor version upgrade settings determine whether the patch applies automatically.
Users not enrolled in auto-update must manually upgrade to the fixed versions. The specific patched versions are 1.4.7.1, 1.4.8.1, and 1.5.0.0. Customers with auto minor version upgrade enabled will receive the update during their next maintenance window. Manual management requires immediate action to apply the correct version.
What should you do?
AWS recommends upgrading your Amazon Neptune DB cluster to a patched engine version. This is the primary remediation for CVE-2026-110812. Until the upgrade is complete, follow least-privilege practices. Grant Neptune neptune-db permissions only to trusted principals. This reduces the risk of an authenticated principal exploiting the flaw.
What to do and how to stay safe: Amazon Neptune
- Check your current Amazon Neptune engine version against the list of patched versions: 1.4.7.1, 1.4.8.1, and 1.5.0.0.
- If you manage versions manually, schedule an upgrade to the nearest compatible patched version for your engine line.
- Review access policies to ensure only trusted principals have Neptune data-plane permissions until the patch is applied.
- Monitor your maintenance windows if auto minor version upgrades are enabled to confirm the update is received.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-110812?
The National Vulnerability Database assigns a CVSS score of 9.9 to this vulnerability.
Which Amazon Neptune versions are fixed?
The issue is addressed in engine versions 1.4.7.1, 1.4.8.1, and 1.5.0.0.
Does this require internet access to exploit?
The flaw requires an authenticated principal with Neptune data-plane permissions, not necessarily internet access.
