Vulnerability · 1 source · latest 3d

AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)

VULNERABILITYCVE-2026-119117redteam/daily · 1 source

Severity: Medium
Highest CVSS: 8.2
Exploited: Not known
Sources: 1

What happened

CVE-2026-119117 (AWS bulletin 2026-159-AWS) covers insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java. Affected are com.amazonaws:amazon-kinesis-producer up to and including 0.15.12, and software.amazon.kinesis:amazon-kinesis-producer before 1.0.8. At DEBUG log level the resolved AWS credentials may be logged, and the library also passes them to the native child process as command-line arguments, readable by local users. The bulletin excerpt does not give a CVSS score or workarounds; defenders should upgrade to 1.0.8 or later, and consider reviewing logs and rotating any credentials that may have been exposed.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist

General advice for this kind of story

Read the full story at the source

Vulnerabilities

CVE-2026-119117CVSS 8.2Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

Amazon Web Services