CVE-2026-77810
Received Received - Intake

Neptune Data Exposure via Athena Federated Query in AWS

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: AMZN

Description
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77810
EUVD
EUVD-2026-64067

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
aws athena_query_federation From 2024.15.1 (inc) to 2026.28.1 (exc)
aws athena_query_federation 2026.30.1
aws aws_athena_query_federation v2026.30.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77810 is a vulnerability in the Amazon Athena Federated Query Neptune Connector. It allows a user with access to Neptune through Athena Federated Query to gain unauthorized access to properties in the Lambda function that provides compute resources for the connector. The issue exists in versions between v2024.15.1 and v2026.28.1.

Detection Guidance

To detect this vulnerability, check the version of your Athena Federated Query Neptune Connector. If it is between v2024.15.1 and v2026.28.1, it is vulnerable. Run commands like 'aws athena get-data-catalog --catalog-name <catalog-name>' to verify the connector version.

Impact Analysis

This vulnerability could allow an attacker with Neptune access via Athena Federated Query to compromise the Lambda function's properties, potentially leading to unauthorized data access, code execution, or service disruption. The high CVSS scores (9.4 v4.0, 9.9 v3.1) indicate significant risk to confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating compliance requirements for data protection such as GDPR (data confidentiality) and HIPAA (protected health information integrity). Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies
  • Upgrade to aws-athena-query-federation v2026.30.1 or later to patch the vulnerability.
  • As a temporary workaround, disable query passthrough on the connector or restrict the athena:StartQueryExecution permission on the Neptune catalog.
  • Ensure passthrough queries only use Gremlin, openCypher, or SPARQL query languages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart