Description
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.



To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Published: 2026-10-30
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Sensitive Data Exposure
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Amazon Kinesis Producer Library for Java causes sensitive credentials to be written to logs when debug logging is enabled, and the same credentials are passed to a native child process via the command line. This allows a local user to read the AWS credentials that the application resolved, leading to unauthorized access to AWS resources.

Affected Systems

Amazon Kinesis Producer Library for Java versions prior to 1.0.8. The vulnerability is present in all builds shipped by AWS under the product amazon-kinesis-producer, regardless of whether the library is fetched via the 0.x or 1.x Maven coordinates.

Risk and Exploitability

The CVSS score of 8.2 reflects a high severity incident of sensitive information disclosure. Local users with read access to the host can exploit the issue by enabling DEBUG logs or by observing the process list, exploiting the library’s behavior. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, but the potential for credential compromise warrants urgent attention, as attackers could assume active IAM roles or create new sessions once the keys are obtained.

Generated by OpenCVE AI on October 30, 2026 at 19:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Amazon Kinesis Producer Library for Java to version 1.0.8 or later.
  • Rotate any long-term IAM user access keys used by the application.
  • Revoke active IAM role sessions that may have been forged with stolen credentials.
  • Restrict or redact log output from the library to prevent credential leakage.
  • If the application uses a 0.x library, migrate to the 1.0.8 or newer Maven coordinate software.amazon.kinesis:amazon-kinesis-producer.

Generated by OpenCVE AI on October 30, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Title Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
First Time appeared Aws
Aws amazon-kinesis-producer
Weaknesses CWE-214
CWE-532
CPEs cpe:2.3:a:aws:amazon-kinesis-producer:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws amazon-kinesis-producer
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Aws Amazon-kinesis-producer
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-30T18:15:42.037Z

Reserved: 2026-10-29T14:19:58.643Z

Link: CVE-2026-119117

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T19:18:20.007

Modified: 2026-10-30T19:23:54.487

Link: CVE-2026-119117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:30:11Z

Weaknesses
  • CWE-214

    Invocation of Process Using Visible Sensitive Information

  • CWE-532

    Insertion of Sensitive Information into Log File