CVE-2026-77810CWE-95

CVE-2026-77810

Critical · published August 22, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00628 · 49.4th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-08-22T00:16Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-087-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/aws-athena-query-federation/releases/tag/v2026.30.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/aws-athena-query-federation/security/advisories/GHSA-v7c2-5wfg-qg44 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 21 AUG 19:34Z
    Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
    cvelistv5