EUVD-2026-64067Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs existing Athena/Neptune query access (PR:L) over the network (AV:N/AC:L); code injection escapes into the Lambda runtime, a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.
AnalysisAI
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be a user who can run Athena Federated Queries against an Amazon Neptune data source served by this connector - i.e., valid Athena/Neptune query access (CVSS PR:L, authenticated). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly aligned toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality, integrity and availability impact on both the vulnerable system and subsequent systems (VC/VI/VA/SC/SI/SA all H), yielding a 9.4 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authorized analyst (or an attacker using stolen analyst credentials) with permission to query Neptune through Athena submits a crafted federated query whose input is evaluated as code by the Neptune connector, causing the connector's Lambda to disclose its own properties. The attacker reads environment configuration and any credentials held by the Lambda, then uses them to pivot deeper into the AWS environment. … |
| Remediation | Vendor-released patch: upgrade the aws-athena-query-federation deployment to v2026.30.1 or later (release: https://github.com/awslabs/aws-athena-query-federation/releases/tag/v2026.30.1), which is the primary and vendor-recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all AWS Athena deployments using the Neptune connector, document current versions, and identify all IAM principals with Athena query permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-95 – Eval Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today