CVE-2026-77810 - Issue with Athena Federated Query Neptune Connector

Amazon Athena Federated Query enables querying data sources outside Amazon S3 using connectors like the Neptune connector. CVE-2026-77810 is a security flaw in the Neptune connector where an attacker with access to Neptune via Athena Federated Query could access properties of the Lambda function that executes the connector's compute logic. This could potentially expose sensitive information or allow unauthorized actions within the Lambda environment. The vulnerability affects Athena Federated Query Neptune connector versions >=2024.15.1 and <=2026.28.1. AWS released a fix in version 2026.30.1 and recommends upgrading or applying specific mitigations.

A user with access to Neptune through Athena Federated Query could gain unauthorized access to properties of the Lambda function that runs the connector's compute logic. This could lead to exposure of sensitive Lambda environment details or potentially unauthorized operations within the Lambda context. No known exploits in the wild have been reported. The impact is limited to users who already have access to Neptune via Athena Federated Query.

AWS has released an official fix in Athena Federated Query version 2026.30.1. It is recommended to upgrade to this version to fully remediate the vulnerability. Alternatively, customers can mitigate the issue by disabling query passthrough on the Neptune connector, restricting the 'athena:StartQueryExecution' permission on the Neptune catalog, or ensuring that passthrough queries only contain Gremlin, openCypher, or SPARQL queries. These mitigations reduce the risk until the upgrade can be applied.