AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)

CVE-2026-119117 (AWS bulletin 2026-159-AWS) covers insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java. Affected are com.amazonaws:amazon-kinesis-producer up to and including 0.15.12, and software.amazon.kinesis:amazon-kinesis-producer before 1.0.8. At DEBUG log level the resolved AWS credentials may be logged, and the library also passes them to the native child process as command-line arguments, readable by local users. The bulletin excerpt does not give a CVSS score or workarounds; defenders should upgrade to 1.0.8 or later, and consider reviewing logs and rotating any credentials that may have been exposed.

For security analysts · Written by AI from 1 source · Wrong?