CVE-2026-77810 Overview
CVE-2026-77810 affects the Neptune connector in the AWS Athena Query Federation SDK. A user with access to Neptune through Athena Federated Query can gain access to properties in the AWS Lambda function supplying the compute for the connector. The flaw is classified under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. AWS published the issue in AWS Security Bulletin 2026-087 and released a fix in aws-athena-query-federation v2026.30.1. The advisory is tracked as GHSA-v7c2-5wfg-qg44.
Critical Impact
An authenticated Athena user querying Neptune can access sensitive Lambda properties, exposing configuration data and enabling further lateral movement in the AWS environment.
Affected Products
- AWS Athena Query Federation SDK — Neptune connector
- aws-athena-query-federation versions prior to v2026.30.1
- Amazon Athena deployments using the Neptune federated data source connector
Discovery Timeline
- 2026-08-21 - CVE-2026-77810 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-77810
Vulnerability Analysis
The Neptune connector runs as an AWS Lambda function that executes federated queries dispatched by Amazon Athena. The connector accepts query input and evaluates it in a context that permits access to Lambda runtime properties. Under [CWE-95], user-controlled input reaches an evaluation path where it should have been treated as data. A caller who can issue Athena Federated Queries against Neptune can therefore read attributes of the Lambda function providing the connector compute.
Exposed properties can include environment variables, execution role context, and other runtime metadata. This data is typically used to hold database credentials, connection strings, and configuration secrets. Disclosure of this material breaks the trust boundary between the Athena query surface and the compute layer that services the query.
Root Cause
The root cause is improper neutralization of directives in dynamically evaluated code within the Neptune connector. The connector evaluates request fields without adequate sandboxing, letting attacker-supplied expressions reference Lambda runtime objects. The fix in v2026.30.1 removes this evaluation pathway.
Attack Vector
Exploitation requires network access to Athena and permissions to run a federated query against a Neptune data source. The attacker submits a crafted query whose expression is evaluated inside the connector Lambda. The response returns Lambda property values back through the standard Athena query result channel. No user interaction is required.
For technical specifics, refer to GitHub Security Advisory GHSA-v7c2-5wfg-qg44.
Detection Methods for CVE-2026-77810
Indicators of Compromise
- Athena query history containing unusual expressions targeting the Neptune connector, especially references to Lambda runtime objects, environment variables, or system properties.
- CloudTrail StartQueryExecution events from unexpected IAM principals invoking Neptune federated data sources.
- Lambda Invoke events for the Neptune connector function with abnormal payload sizes or error patterns.
Detection Strategies
- Enable Athena query logging and inspect SELECT statements against Neptune catalogs for injected expressions or non-standard function calls.
- Correlate CloudTrail Athena events with Lambda CloudWatch logs from the connector to identify queries that trigger property access paths.
- Alert on Neptune federated queries executed by principals that do not normally access Neptune data.
Monitoring Recommendations
- Forward Athena, Lambda, and CloudTrail logs to a central analytics platform and baseline query patterns per identity.
- Monitor IAM activity on the Lambda execution role associated with the Neptune connector for anomalous API calls that may indicate credential reuse.
- Track the deployed version of aws-athena-query-federation across accounts and flag any connector Lambdas older than v2026.30.1.
How to Mitigate CVE-2026-77810
Immediate Actions Required
- Upgrade the Neptune connector to aws-athena-query-federationv2026.30.1 or later in every AWS account and Region where it is deployed.
- Rotate any secrets, credentials, or connection strings that were stored in the connector Lambda environment variables or referenced via its execution role.
- Review Athena query history for suspicious federated queries against Neptune since the connector was deployed.
Patch Information
AWS remediated the issue in aws-athena-query-federation v2026.30.1. Redeploy the Neptune connector using the updated release artifact from the AWS Serverless Application Repository or by rebuilding from source at the fixed tag. Confirm the Lambda function code hash matches the patched release after deployment.
Workarounds
- Restrict IAM permissions so only required principals can call athena:StartQueryExecution against the Neptune data source.
- Remove sensitive values from the connector Lambda environment variables and source them from AWS Secrets Manager with least-privilege access.
- Disable or delete the Neptune connector Lambda until the patched version is deployed if Neptune federation is not actively required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
