---
title: Amazon Neptune CVE-2026-110812 (CVSS 9.9): Gremlin graph-import deserialization lets a query-permission user run code and reach internal service credentials; fixed in 1.5.0.0 / 1.4.8.1 / 1.4.7.1 | ctxsec
url: https://ctxsec.com/items/amazon-neptune-cve-2026-110812
description: ""
status: "confirmed (AWS bulletin 2026-136-AWS); no known exploitation reported"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/amazon-neptune-cve-2026-110812.md)

confirmed (AWS bulletin 2026-136-AWS); no known exploitation reported

2026-10-15

### Amazon Neptune CVE-2026-110812 (CVSS 9.9): Gremlin graph-import deserialization lets a query-permission user run code and reach internal service credentials; fixed in 1.5.0.0 / 1.4.8.1 / 1.4.7.1

AWS bulletin 2026-136-AWS (Oct 15) covers a deserialization bug in the Gremlin graph-data import path of the Amazon Neptune engine, tied to Apache TinkerPop. Per the CVE record, an authenticated user with ordinary Neptune data-plane (query) permissions could execute arbitrary code and access internal service credentials (CVSS 3.1 9.9, scope changed). It affects engine versions 1.2.0.0 and later. Fixes are in engine versions 1.5.0.0, 1.4.8.1 and 1.4.7.1. Clusters with auto minor version upgrade get the fix in their next maintenance window; clusters that pin engine versions must be upgraded manually. Until then, AWS says to grant neptune-db query permissions only to trusted principals. AWS doesn't mention exploitation.

Sources: [AWS security bulletin 2026-136-AWS](https://aws.amazon.com/security/security-bulletins/2026-136-aws/) · [CVE-2026-110812](https://www.cve.org/CVERecord?id=CVE-2026-110812) · [Neptune 1.5.0.0 release notes](https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html)