Executive brief
AWS Graph Explorer is a tool for querying and managing graph databases in AWS. A vulnerability allows the application to fall back from secure HTTPS connections to unencrypted HTTP, exposing sensitive data in transit to interception. An attacker positioned on the network could eavesdrop on communications and steal authentication tokens or sensitive query data.
Technical details
The vulnerability is a protocol downgrade flaw in AWS Graph Explorer where HTTPS connections are permitted to degrade to HTTP under certain conditions. This is a form of man-in-the-middle (MITM) attack vector that requires network adjacency or the ability to intercept traffic (e.g., on shared Wi-Fi, compromised network, or via DNS/ARP spoofing). An attacker positioned on the network path can force or observe the downgrade and capture unencrypted traffic containing API requests, responses, authentication tokens, and graph query data. Since the fallback is implicit in the application logic rather than user-initiated, it can occur transparently. A patch restricting connections to HTTPS-only is expected to resolve this issue.
Affected products
- AWS Graph Explorer
Timeline
- 2026-09-22: disclosed