Read the docs
TI-2026-83279 Aliases CVE-2026-119117

Amazon Kinesis Producer Library for Java leaks AWS credentials

Priority LOW 35CWE-214Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Amazon Kinesis Producer Library for Java before 1.0.8 writes sensitive information into a log file when its logger is set to DEBUG level (CWE-532). Affected versions also pass AWS credentials to the native child process as command-line arguments. A local user with low privileges may be able to read these credentials from the log or the process argument list.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00151 4th percentileScored 2026-11-07
Fix Fixed amazon-kinesis-producer (AWS): 1.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSamazon-kinesis-producerup to 0.15.12—No fix listedCNA
AWSamazon-kinesis-producerbefore 1.0.81.0.8Patch availableCNA
  • amazon-kinesis-producer VendorAWS Affected up to 0.15.12 Fixed in — No fix listed CNA
  • amazon-kinesis-producer VendorAWS Affected before 1.0.8 Fixed in 1.0.8 Patch available CNA

Remediation

Upgrade to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later, and rotate any long-term IAM user keys and revoke active role sessions where needed. Restrict or redact log data written by an affected version. The sources list no fixed version for amazon-kinesis-producer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA amazon-kinesis-producer (AWS) Fixed in 1.0.8

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119117
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 2

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences