Paper/Archive/CVE-2026-77810

CVE-2026-77810

AWS Athena Federated Query Neptune Connector — Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

EPSS 0.6%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 50.1.501 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

Affected

ProductAffectedFixed inSource

Athena Federated Query Neptune Connector2024.15.1 – 2026.28.1–CNA

Scores by source

AMZN (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AMZN (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/awslabs/aws-athena-query-federation/releases/tag/v2026.30.1 advisoryaws.amazon.com/security/security-bulletins/2026-087-aws writeupgithub.com/awslabs/aws-athena-query-federation/security/advisories/GHSA-v7c2-5wfg-qg44