Amazon Neptune Engine
Monthly
Amazon Neptune engine versions prior to 1.5.0.0 contain a deserialization flaw in the Gremlin graph data import component that lets an authenticated remote actor holding standard database permissions execute arbitrary code and reach internal service credentials. Exploitation requires working database credentials and network access to the Gremlin import interface, so exposure is greatest in multi-user, multi-tenant, or lower-trust deployments where untrusted parties hold standard DB accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high CVSS 4.0 score (9.4) and our independent CVSS 3.1 assessment (8.8, scope-changed, high confidentiality/integrity/availability impact) confirm this is a genuine high-priority issue rather than a CVSS-inflated one. Vendor-released patches are available as engine version 1.5.0.0 with backports to 1.4.8.1 and 1.4.7.1, and clusters enrolled in auto-update may be remediated without operator action.
Amazon Neptune engine versions prior to 1.5.0.0 contain a deserialization flaw in the Gremlin graph data import component that lets an authenticated remote actor holding standard database permissions execute arbitrary code and reach internal service credentials. Exploitation requires working database credentials and network access to the Gremlin import interface, so exposure is greatest in multi-user, multi-tenant, or lower-trust deployments where untrusted parties hold standard DB accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high CVSS 4.0 score (9.4) and our independent CVSS 3.1 assessment (8.8, scope-changed, high confidentiality/integrity/availability impact) confirm this is a genuine high-priority issue rather than a CVSS-inflated one. Vendor-released patches are available as engine version 1.5.0.0 with backports to 1.4.8.1 and 1.4.7.1, and clusters enrolled in auto-update may be remediated without operator action.