CVE-2026-110812 with a CVSS score of 9.9 is a critical unsafe deserialization vulnerability in the Apache TinkerPop Gremlin graph-import path of the Amazon Neptune Engine. The affected component is the Neptune query engine, where the service fails to safely deserialize untrusted data. Affected versions are all engine versions greater than or equal to 1.2.0.0. Exploitation requires an authenticated principal who already holds Neptune data-plane query permissions and can submit a crafted request under certain conditions. That request causes the query engine to process untrusted input unsafely, potentially leading to unintended activity within the query engine environment. Because Amazon Neptune is a fully managed graph database service used by enterprises to process connected data sets, a critical flaw in the query engine can expose cloud database environments to severe risk. The business impact includes potential compromise of the underlying query engine, disruption of graph database operations, and exposure of connected data processing to unauthorized activity. The vulnerability is severe because it affects a core database query path and can be triggered by a credentialed user rather than an unauthenticated external actor, making credential-based access a significant operational concern.
We recommend you to update AWS Amazon Neptune Engine to version 1.5.0.0, 1.4.7.1, or 1.4.8.1 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-110812 with a CVSS score of 9.9 is a critical unsafe deserialization vulnerability in the Apache TinkerPop Gremlin graph-import path of the Amazon Neptune Engine. The affected component is the Neptune query engine, where the service fails to safely deserialize untrusted data. Affected versions are all engine versions greater than or equal to 1.2.0.0. Exploitation requires an authenticated principal who already holds Neptune data-plane query permissions and can submit a crafted request under certain conditions. That request causes the query engine to process untrusted input unsafely, potentially leading to unintended activity within the query engine environment. Because Amazon Neptune is a fully managed graph database service used by enterprises to process connected data sets, a critical flaw in the query engine can expose cloud database environments to severe risk. The business impact includes potential compromise of the underlying query engine, disruption of graph database operations, and exposure of connected data processing to unauthorized activity. The vulnerability is severe because it affects a core database query path and can be triggered by a credentialed user rather than an unauthenticated external actor, making credential-based access a significant operational concern.
We recommend you to update AWS Amazon Neptune Engine to version 1.5.0.0, 1.4.7.1, or 1.4.8.1 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]