CVE-2026-77810 - Issue with Athena Federated Query Neptune Connector

CVE-2026-77810 - Issue with Athena Federated Query Neptune Connector

Bulletin ID: 2026-087-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/21/2026 12:30 PM PDT

Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. These connectors are open source and deployed to the Athena service on a regular basis.

We identified CVE-2026-77810, in the Neptune connector where a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector.

Impacted versions: <=v2026.28.1 AND >=v2024.15.1

This issue has been addressed in Athena Federated Query version v2026.30.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Alternatively, customers can mitigate this issue by disabling query passthrough on the connector, restricting athena:StartQueryExecution on the Neptune catalog, or ensure the passthrough query only contains Gremlin, openCypher, or SPARQL.