rewindex

RewindexCVEsAmazon Web Services

CVE-2026-119117: Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Medium · CVSS 6.5 (CVSS 3.1)EPSS 0.15%, 4th percentilePublished Updated Assigner: AMZN

Description

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · CWE-214, CWE-532

Tracked companies

Amazon Web Services

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

AWS: amazon-kinesis-producer

References

All CVEsMarkdownJSON