AWS has released a security bulletin confirming a critical vulnerability in Amazon Neptune, tracked as CVE-2026-110812, with a CVSS score of 9.9 (v3). The flaw stems from unsafe deserialization of untrusted data within the Apache TinkerPop Gremlin query engine, specifically along Neptune’s graph-import path.
According to the advisory, under certain conditions an authenticated user with Neptune data-plane (query) permissions can issue a crafted request that causes the query engine to process untrusted input unsafely, potentially enabling unintended activity within the engine environment. The issue affects Neptune engine versions starting from 1.2.0[.]0 and before the patched releases.
AWS states that the vulnerability has been addressed in Neptune engine versions 1.4.7[.]1, 1.4.8[.]1 and 1.5.0[.]0. All customers should upgrade to one of these patched revisions as soon as possible; those with automatic minor version upgrades enabled will receive the update in their next maintenance window, while customers managing engine versions manually should perform an upgrade.
In the meantime, AWS recommends applying least-privilege access and restricting Neptune query permissions to trusted principals to reduce exposure. At the time of the bulletin, there had been no publicly confirmed exploitation published, but the combination of a critical severity and the authenticated-deserialization vector warrants urgent action for Neptune deployments.