Advisoriesby IbisDeserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Bulletin ID: 2026-136-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/15/2026 09:30 AM PDT Description: Amazon Neptune is a fully managed graph database service. We identified CVE-2026-110812, an issue in Apache TinkerPop related to Gremlin functionality used by Amazon Neptune. Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that causes the query engine to process untrusted input unsafely, which could lead to unintended activity within the query engine environment. This issue has been addressed in the engine versions listed below; we recommend customers upgrade. Impacted versions: >=1.2.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsCVE-2026-99999no fix yetUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows...CVE-2026-15957no fix yetImproper Link Resolution in Auth.GetUserPrivateKey in AWS Research and Engineering StudioCVE-2026-14904no fix yetImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK...CVE-2026-12530no fix yetKey commitment policy bypass via shared key cache in AWS Encryption SDK for PythonCVE-2026-6550no fix yetLocal Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight AgentCVE-2026-7791no fix yet