Amazon Neptune: Deserialization of untrusted data in Gremlin graph import

Summary

Amazon Neptune, AWS's managed graph database service, contains a deserialization flaw in the Gremlin graph import path, tracked as CVE-2026-110812. An authenticated user with standard Neptune query (neptune-db) permissions can submit a crafted request that makes the query engine process untrusted input unsafely. The CVE record states this could allow code execution and access to internal service credentials. Exploitation requires valid database credentials, and AWS has fixed the issue in patched engine versions.

Affected

• Amazon Neptune engine 1.2.0.0 and later (per AWS bulletin 2026-136-AWS)
• The CVE record lists 1.2.0.0 to below 1.5.0.0 as affected, with 1.4.7.1 and 1.4.8.1 as unaffected

Fixed in

• Amazon Neptune engine 1.4.7.1 (backport on the 1.4.x line)
• Amazon Neptune engine 1.4.8.1
• Amazon Neptune engine 1.5.0.0

Unknown: whether builds between 1.2.0.0 and the patched versions are fixed. Do not assume any other version is safe.

Workaround

• Until the upgrade is done, grant neptune-db (query) permissions only to trusted principals and apply least-privilege practices.
• This is an interim measure only. AWS recommends upgrading the DB cluster to a patched engine version.

Exploitation

• No exploitation in the wild has been reported in the CVE record or the AWS bulletin.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof-of-concept code was found in the research.

Our recommendation

• Check whether any Neptune clusters are in use and which engine version they run.
• Take a manual snapshot, then upgrade to 1.4.7.1, 1.4.8.1 or 1.5.0.0 for the matching engine line. Auto minor version upgrade applies the fix in the next maintenance window.
• Review and reduce who holds neptune-db query permissions.
• Confirm that the cluster is not reachable from untrusted networks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• AWS Security Bulletin 2026-136-AWS aws.amazon.com
• Amazon Neptune engine release 1.4.7.1 docs.aws.amazon.com
• Amazon Neptune engine release 1.4.8.1 docs.aws.amazon.com
• Amazon Neptune engine release 1.5.0.0 docs.aws.amazon.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:01.