AWS Fixes Gremlin Graph-Import Deserialization in Amazon Neptune
Tech GuruQuick Answer
AWS published 2026-136-AWS for CVE-2026-110812 in Amazon Neptune. Inventory engine lines and principals with data-plane query permission, move each cluster to 1.4.7.1, 1.4.8.1, or 1.5.0.0 as applicable, validate Gremlin workloads, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Neptune clusters, engine lines, auto-minor-upgrade settings, and principals with neptune-db query permissions; deploy the corresponding patched engine; validate Gremlin and graph-import workflows; and review query activity for misuse.
Last verified: 2026-10-16 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Amazon Neptune DB clusters using engine versions 1.2.0.0 or later |
|---|---|
| Advisory | 2026-136-AWS |
| CVE | CVE-2026-110812 |
| Authoritative release date | 2026-10-15 16:30:00 UTC |
| Authority revision date | 2026-10-15 16:30:00 UTC |
| Affected versions | Amazon Neptune engine versions 1.2.0.0 or later before the corresponding patched 1.4.7, 1.4.8, or 1.5.0 engine line, where an authenticated principal has Neptune data-plane query permission. |
| Fixed version | Amazon Neptune engine 1.4.7.1, 1.4.8.1, or 1.5.0.0, matched to the deployed engine line |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
AWS says a principal with Neptune data-plane query permission could submit input that the Gremlin query engine processes unsafely. AWS released patched engine versions and recommends upgrading; least privilege is an interim control.
What To Validate Now
- Inventory. Locate Amazon Neptune DB clusters using engine versions 1.2.0.0 or later deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Amazon Neptune engine versions 1.2.0.0 or later before the corresponding patched 1.4.7, 1.4.8, or 1.5.0 engine line, where an authenticated principal has Neptune data-plane query permission. Do not infer applicability from product family or severity alone.
- Remediate. Apply Amazon Neptune engine 1.4.7.1, 1.4.8.1, or 1.5.0.0, matched to the deployed engine line through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not treat auto minor version upgrade as proof that a maintenance window has completed. The issue requires an authenticated data-plane principal, but that precondition does not replace upgrading or least-privilege review. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
