AWS Athena Neptune Connector Privilege Escalation via Lambda Permissions (CVE-2026-77810)

Vulnerability Overview Vulnerability Name: Issue with Athena Federated Query Neptune Connector Vulnerability ID: GHSA-v7c2-5wfg-qq44 CVSSv3.1 Score: 9.9 CVSSv3.1 Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Description: Amazon Athena is a serverless interactive query service that allows users to analyze data in Amazon S3 using standard SQL. Athena Federated Query is a feature that enables querying data from sources other than Amazon S3 (such as DynamoDB, Azure Synapse, and custom connectors). These connectors are open-source and are deployed regularly to the Athena service. Issue: A vulnerability was identified in the Neptune connector, where users with permissions to access Neptune via Athena Federated Query may obtain attribute-level access permissions to the Lambda functions that provide the connector's computational resources. Affected Scope Affected Versions: =v2026.30.1 Impact: Users with permissions to access Neptune via Athena Federated Query may obtain attribute-level access permissions to the Lambda functions that provide the connector's computational resources. Remediation Patch: This issue has been resolved in the Athena Federated Query connector version v2026.30.1. It is recommended to upgrade to the latest version and ensure that any forked or derived code includes the new fix. Workaround: As an alternative, customers can mitigate this issue by disabling query passthrough on the connector, restricting the action on Neptune databases, or ensuring that passthrough queries contain only Gremlin, openCypher, or SPARQL. References For any questions or comments, please contact AWS Security via the vulnerability reporting page or directly via email at aws-security@amazon.com. Do not create public GitHub issues. Additional Information CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2026-77810 Weaknesses: CWE-95 Code Snippet No Proof of Concept (PoC) or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

AWS Athena Neptune Connector Privilege Escalation via Lambda Permissions (CVE-2026-77810)

More from this source