---
title: Tip: find Neptune instances still exposed to CVE-2026-110812 in one CLI call per region | ctxsec
url: https://ctxsec.com/items/tip-neptune-engine-version-check
description: ""
status: "confirmed (AWS bulletin)"
published: 2026-10-18
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-neptune-engine-version-check.md)

confirmed (AWS bulletin)

2026-10-18

### Tip: find Neptune instances still exposed to CVE-2026-110812 in one CLI call per region

Run this in each region you use, and flag anything not on 1.5.0.0, 1.4.8.1 or 1.4.7.1 (or later). Also flag any instance with auto minor version upgrade set to False, since those won't patch themselves:

```
aws neptune describe-db-instances --region us-east-1 \
  --query 'DBInstances[?Engine==`neptune`].[DBInstanceIdentifier,DBClusterIdentifier,EngineVersion,AutoMinorVersionUpgrade]' \
  --output table
```

Then list which IAM principals have neptune-db:* or neptune-db:connect access. The bug needs only query permissions, so app roles and shared analyst roles count, not just admins.

Sources: [AWS security bulletin 2026-136-AWS](https://aws.amazon.com/security/security-bulletins/2026-136-aws/) · [CVE-2026-110812](https://www.cve.org/CVERecord?id=CVE-2026-110812)