Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)

2. Oct 15, 2026 · NIST NVD

   Updated

   Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

Sources

• CVE.orgVulnerability recordCVE-2026-110812

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-110812

  Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users

  nvd.nist.gov

References

• Reference · aws.amazon.com
• Reference · docs.aws.amazon.com
• Reference · docs.aws.amazon.com
• Reference · docs.aws.amazon.com