Neptune Connector Unauthorized Access via Athena Federated Query pre-2026.30.1
CVE-2026-77810 Published on August 21, 2026

Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-77810 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an Eval Injection Vulnerability?

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.

CVE-2026-77810 has been classified to as an Eval Injection vulnerability or weakness.


Products Associated with CVE-2026-77810

Want to know whenever a new CVE is published for Aws Athena Federated Query Neptune Connector? stack.watch will email you.

Aws Athena Federated Query Neptune Connector
 

Affected Versions

AWS Athena Federated Query Neptune Connector: