Bulletin ID: 2026-136-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/15/2026 09:30 AM PDT

Description:

Amazon Neptune is a fully managed graph database service. We identified CVE-2026-110812, an issue in Apache TinkerPop related to Gremlin functionality used by Amazon Neptune. Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that causes the query engine to process untrusted input unsafely, which could lead to unintended activity within the query engine environment. This issue has been addressed in the engine versions listed below; we recommend customers upgrade.

Impacted versions: >=1.2.0.0

Resolution:

This issue has been addressed in Amazon Neptune engine versions 1.4.7.1, 1.4.8.1 and 1.5.0.0. We recommend upgrading your Amazon Neptune DB cluster to the corresponding patched version for your engine line. Customers with auto minor version upgrade enabled will receive the update during their next maintenance window; customers who manage engine versions manually should upgrade.

Workarounds:

This issue requires an authenticated principal with data-plane access. Until you can upgrade, follow least-privilege practices and grant Neptune neptune-db (query) permissions only to trusted principals. Upgrading your DB cluster to a patched Neptune engine version is the recommended remediation.

References:

• CVE-2026-110812

Please email aws-security@amazon.com with any security questions or concerns.