Neptune Connector Vulnerability in AWS Athena Federated Query
CVE-2026-77810

9.4CRITICAL

Key Information:

Vendor

Aws

Status
Athena Federated Query Neptune Connector
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77810?

A security vulnerability has been identified in the Neptune connector of AWS Athena, allowing users with access to Neptune via Athena Federated Query to potentially access sensitive properties within the Lambda service that supports the connector. To mitigate this risk, it is essential for users to update to aws-athena-query-federation v2026.30.1 or newer versions.

Affected Version(s)

Athena Federated Query Neptune Connector 2024.15.1 <= 2026.28.1

References

https://github.com/awslabs/aws-athena-query-federation/re...
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/awslabs/aws-athena-query-federation/se...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.