Description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Published: 2026-10-15
Score: 9.4 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x) Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CPEs cpe:2.3:a:aws:amazon_neptune_engine:1.4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:aws:amazon_neptune_engine:1.4.8.1:*:*:*:*:*:*:*

Thu, 15 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)
Title Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
First Time appeared Aws
Aws amazon Neptune Engine
Weaknesses CWE-502
CWE-918
CPEs cpe:2.3:a:aws:amazon_neptune_engine:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws amazon Neptune Engine
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Aws Amazon Neptune Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-15T18:20:19.757Z

Reserved: 2026-10-14T19:48:17.745Z

Link: CVE-2026-110812

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T17:17:16.110

Modified: 2026-10-15T19:17:23.697

Link: CVE-2026-110812

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

  • CWE-918

    Server-Side Request Forgery (SSRF)