---
id: CVE-2026-110812
title: >-
  Deserialization of untrusted data in the Gremlin graph data import component
  in Amazon Neptune engine might allow an authenticated remote actor with
  standard database permissions to execute arbitrary code and access internal
  service cred…
summary: >-
  Deserialization of untrusted data in the Gremlin graph data import component
  in Amazon Neptune engine might allow an authenticated remote actor with
  standard database permissions to execute arbitrary code and access internal
  service cred…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-502
  - CWE-918
vendor: AWS
product: Amazon Neptune Engine
affected:
  - amazon_neptune_engine >= 1.2.0.0 < 1.5.0.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:23.697'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110812'
references:
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-136-aws/'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: >-
      https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: >-
      https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: >-
      https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T17:18:20.097Z'
---

## Overview

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.