CVE-2026-77810

The near-maximum CVSS score attached to what the advisory describes as 'properties exposure' is the first signal that something more serious than the wording suggests. In practice, this vulnerability lives in the Athena Federated Query connector's Lambda-backed compute layer—not in Neptune itself—and the 9.9 score most likely reflects confirmed credential extraction through that Lambda's runtime context. When Lambda functions cold-start, AWS injects the execution role's IAM credentials, STS temporary tokens, and potentially secrets from Parameter Store directly into environment variables. If the connector exposed those runtime properties through its federated query response path, an attacker with Athena federation permissions could retrieve them without ever needing direct Neptune access or code execution. This is not merely a patch-and-move-on flaw. The federated query architecture creates a credential inheritance pipeline that most organizations deployed without recognizing: anyone granted Athena federation permissions—BI tools, data analysts, third-party applications—inherits whatever access the connector's execution role was granted, typically broad read access to Neptune. If that role has transitive permissions to S3, Secrets Manager, or other services, those become part of the attacker's prize. The upgrade to aws-athena-query-federation v2026.30.1 is required, but it addresses only this connector. The deeper architectural pattern—Lambda credentials in environment variables exposed through federated query surfaces—remains intact across other connectors (DynamoDB, OpenSearch, Redshift, and any custom federated sources). Organizations should audit all Lambda-backed Athena federation connectors in their environment, verify deployed versions, and treat the upgrade as a redeployment task, not a configuration change. CloudFormation, SAM, and Terraform deployments require active re-provisioning. The more insidious risk is orphaned connectors: Lambda functions deployed for proofs-of-concept in 2021 and never touched, attached to stacks where the owning team has disbanded. These forgotten deployments will not receive the patch, and the public CVE now makes them exploitable. Inventory systems that treat serverless compute as 'ephemeral' and skip asset tracking are the gap attackers will target. Treat every historical Athena federation connector as a potential exposure window until proven otherwise.

Reviewed through automated stages and approved by a human before publication.