A critical code injection vulnerability in the AWS Athena Federated Query Neptune Connector enables authenticated users to escalate their access to the underlying Lambda compute environment.

The connector is vulnerable to improper neutralization of directives in dynamically evaluated code (CWE-95). An authenticated user can leverage this flaw to execute unauthorized operations within the Lambda function context.

Successful exploitation allows an authenticated user to gain access to sensitive properties within the Lambda execution environment. With a CVSS score of 9.9, this vulnerability carries a severe risk of unauthorized access to cloud compute resources, potentially leading to cross-tenant data exposure or further compromise of the AWS environment.

Immediate Action: Upgrade the AWS Athena Federated Query Neptune Connector to version 2026.30.1 or later to remediate the vulnerable code path.

Proactive Monitoring: Monitor CloudWatch logs for abnormal Lambda function execution patterns or unauthorized attempts to access environment variables and configuration properties.

Compensating Controls: Apply the principle of least privilege by restricting IAM roles associated with the Lambda function, ensuring they only have the minimum permissions required for operation.

Public Exploit Available: Unknown (no confirmed public exploit in available data)

Given the high impact on cloud compute integrity, administrators must verify the version of the Neptune connector in use. Transitioning to version 2026.30.1 is mandatory to mitigate the risk of unauthorized access to the Lambda compute environment.