Sign inGet the app

Vulnerability · 1 source · latest 2h

AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)

Severity
Medium
Highest CVSS
8.2
Exploited
Not known
Sources
1

What happened

AWS published CVE-2026-119117 affecting the Amazon Kinesis Producer Library for Java. When the logger is set to DEBUG, the AWS credentials the library resolved can be written to log files. Separately, affected versions pass the credentials to the native child process as command-line arguments, so a local user can read them from the process argument list. Versions before 1.0.8 are affected.

For IT people · Written by AI from 1 source · Wrong?

Read the full story at the sourceAsk about this story

Vulnerabilities

Full story timeline · 2 updates

  1. Fri 30 OctoberCVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for JavaAWS Security Bulletins
  2. CVE-2026-119117 published, CVSS 8.2NVD

Who reported · 1 outlet

AWS Security Bulletins

Report a problem