CVE-2026-110812: Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Published Oct 15, 2026

Updated

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.

To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)

Affected Software

1 affected component

Amazon Neptune engine

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Amazon Neptune engine to a version that resolves this vulnerability.
Fixed in 1.5.0.0

Event History

Oct 15, 2026

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated remote actor with standard Amazon Neptune database permissions can exploit the affected Gremlin graph data import component. No user interaction is required.

Which deployments need to be upgraded?

Users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0. Backports are available for the 1.4.8.x and 1.4.7.x engine branches.

What could an attacker gain from successful exploitation?

Successful exploitation may allow arbitrary code execution and access to internal service credentials. The stated impact includes high confidentiality, integrity, and availability consequences.