CVE-2026-119117
Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Amazon Kinesis Producer Library

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: AMZN

Description
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119117
EUVD
EUVD-2026-114267

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
AWS amazon-kinesis-producer 0
AWS amazon-kinesis-producer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.
CWE-214 A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Amazon Kinesis Producer Library for Java before version 1.0.8. When the library's logger is set to DEBUG level, it may log sensitive AWS credentials. Additionally, these credentials are passed to a native child process as command-line arguments, which local users could potentially access.

Detection Guidance

Check if the Amazon Kinesis Producer Library for Java version is below 1.0.8 by inspecting the library files or dependency manifests. Review log files for AWS credentials if the logger is set to DEBUG level. Examine process arguments for exposed credentials in child processes.

Impact Analysis

Local attackers could obtain AWS credentials from log files or process arguments, leading to unauthorized access to AWS resources. This could result in data breaches, resource misuse, or elevated privileges if the credentials have sufficient permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties and reputational damage if credentials are exposed.

Mitigation Strategies

Upgrade to version 1.0.8 or later of the library. Rotate any long-term IAM user keys and revoke active role sessions. Restrict or redact log data written by affected versions. Migrate 0.x users to the fixed version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119117. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart