Athena Federated Query Neptune Connector
Monthly
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.