CVE-2026-119117
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- First covered by RedTeamDaily
- Published by NVD
- Last updated by NVD
Coverage
AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)
AWS published CVE-2026-119117 affecting the Amazon Kinesis Producer Library for Java. When the logger is set to DEBUG, the AWS credentials the library resolved can be written to log files. Separately, affected versions pass the credentials to the native child process as command-line arguments, so a local user can read them from the process argument list. Versions before 1.0.8 are affected.
Sources: NVD and CISA known exploited vulnerabilities catalogue.