Amazon Neptune CVE-2026-110812 Gremlin Deserialization Bug Patches RCE and Credential Theft

Amazon Neptune customers using graph import features face a critical security risk due to CVE-2026-110812, a deserialization flaw in the Gremlin component. According to the AWS Security Bulletin published on October 15, 2026, an authenticated principal with standard database query permissions can exploit this issue. The bug allows remote actors to process untrusted input unsafely, potentially leading to arbitrary code execution within the query engine environment. This exposure affects environments where users have direct data-plane access to the graph database.

Root cause

The underlying issue resides in the Apache TinkerPop library, which powers the Gremlin functionality used by Amazon Neptune. The National Vulnerability Database classifies the weakness under CWE-502 and CWE-918, indicating deserialization of untrusted data. The query engine processes untrusted input unsafely under certain conditions. This lapse enables the system to handle data in a way that could lead to unintended activity within the query engine environment, bypassing standard safety checks within the managed service environment.

Attack path

An attacker must first obtain valid credentials for a principal that holds Neptune data-plane permissions. According to the official advisory, this access allows the submission of requests that trigger the unsafe processing of untrusted input. Once the request reaches the Gremlin graph import component, the engine executes the deserialization routine. This action can lead to unintended activity within the query engine environment, including the execution of arbitrary code. Successful exploitation may grant the attacker access to internal service credentials stored within the cluster.

Affected versions

The vulnerability impacts Amazon Neptune engine versions 1.2.0.0 and later, up to but not including the patched releases. The National Vulnerability Database notes that versions up to 1.5.0.0 are affected. AWS explicitly lists the following engine versions as vulnerable before remediation:

• Engine version 1.4.7.0 and earlier in the 1.4.7.x line
• Engine version 1.4.8.0 and earlier in the 1.4.8.x line
• Engine versions prior to 1.5.0.0

Mitigation

AWS has released fixes for all supported minor version lines. Customers should upgrade their Amazon Neptune DB clusters to the corresponding patched versions listed in the security bulletin. The specific remediated versions include 1.4.7.1, 1.4.8.1, and 1.5.0.0. Users enrolled in auto-update will receive these updates during their next scheduled maintenance window. Those managing engine versions manually must initiate the upgrade process immediately to close the security gap.

Signals worth monitoring

Security teams should review database audit logs for unusual graph import activity or unexpected command execution patterns. Look for spikes in query complexity or resource utilization that do not align with normal application behavior. Check for outbound network connections from the database layer to unknown destinations, which could indicate credential exfiltration. Verify that all database principals adhere to the principle of least privilege, ensuring that only trusted users have data-plane access. Regularly monitor for any unexpected changes in user permissions or role assignments within the AWS console.

What to do and how to stay safe: Amazon Neptune

• Verify your current Amazon Neptune engine version and compare it against the list of patched releases provided by AWS.
• Ensure that auto minor version upgrade is enabled for your clusters to receive the fix during the next maintenance window.
• Restrict Neptune data-plane permissions to only trusted principals who require direct query access to mitigate immediate risk.
• Monitor database logs for anomalous graph import requests or unauthorized attempts to execute code within the query environment.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-110812 with a CVSS score of 9.9, classifying it as critical.

Do I need to be an administrator to exploit this flaw?

No, the advisory states that an authenticated principal with standard Neptune data-plane or query permissions is sufficient to trigger the issue.

When was this security bulletin published?

AWS published the security bulletin on October 15, 2026, at 09:30 AM PDT.