Vulnerability · 1 source · latest 3d

AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)

VULNERABILITYCVE-2026-119117redteam/daily · 1 source

Severity: Medium
Highest CVSS: 8.2
Exploited: Not known
Sources: 1

What happened

Amazon has warned of a flaw in a Java tool that sends data to its Kinesis streaming service. In some set-ups, the tool can write secret AWS login details into its log files, and it can also expose them to other users on the same computer. Users should move to the fixed version.

Like I’m new · Written by AI from 1 source · Wrong?

What to do

Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist

General advice for this kind of story

Read the full story at the source

Vulnerabilities

CVE-2026-119117CVSS 8.2Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

Amazon Web Services