Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-77810— Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

Quick assessment

Affected

AWS Athena Federated Query Neptune Connector

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Amazon Athena Federated Query Neptune Connector是美国Amazon公司的一款可实现图数据库联合查询的查询连接器。 Amazon Athena Federated Query Neptune Connector 2024.15.1版本至2026.28.1版本存在代码注入漏洞，该漏洞源于用户通过Athena Federated Query访问Neptune时可获取Lambda属性访问权限。

CVSS 9.9 · Critical EPSS 0.63% · P50 Updated Aug 28, 2026

Possible ATT&CK Techniques 2 AI

T1592 · Gather Victim Host Information T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

Vendor	Product	Version Range	Status
AWS	Athena Federated Query Neptune Connector	`2024.15.1≤ 2026.28.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77810

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

Source: CVE Program / CVE List V5

Vulnerability Description

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

动态执行代码中指令转义处理不恰当(Eval注入)

Source: CVE Program / CVE List V5

Vulnerability Title

Amazon Athena Federated Query Neptune Connector 代码注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AWS	Athena Federated Query Neptune Connector	2024.15.1 ~ 2026.28.1	-

II. Public POCs for CVE-2026-77810

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 10697 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-77810

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77810 (2)

🔗 CVE-2026-77810 - Issue with Athena Federated Query Neptune Connector Read full article vendor-advisory
🔗 Issue with Athena Federated Query Neptune Connector · Advisory · awslabs/aws-athena-query-federation · GitHub Read full article third-party-advisory

Vendor Pages for CVE-2026-77810 (1)

🔗 Release Release v2026.30.1 of Athena Query Federation · awslabs/aws-athena-query-federation · GitHub patch

https://www.cve.org/CVERecord?id=CVE-2026-77810

IV. Related Vulnerabilities

Same vendor: AWS

Same weakness: CWE-95