Vulnerability · 1 source · latest 3d

AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)

VULNERABILITYCVE-2026-119117redteam/daily · 1 source

Severity: Medium
Highest CVSS: 8.2
Exploited: Not known
Sources: 1

What happened

AWS published CVE-2026-119117 affecting the Amazon Kinesis Producer Library for Java. When the logger is set to DEBUG, the AWS credentials the library resolved can be written to log files. Separately, affected versions pass the credentials to the native child process as command-line arguments, so a local user can read them from the process argument list. Versions before 1.0.8 are affected.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist

General advice for this kind of story

Read the full story at the source

Vulnerabilities

CVE-2026-119117CVSS 8.2Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

Amazon Web Services