Live › vulnerability › CVE-2026-104002
Go to dashboardThe data masking utility in Powertools for AWS Lambda (Python) returns the original value when masking fails instead of masking it. An actor who can read the function's output or logs can see field values the application meant to hide.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC, 1h before NVD. All times on this page are UTC.
Applications that run Powertools for AWS Lambda (Python) between versions 3.6.0 and 3.34.0 and rely on its data masking utility to hide sensitive fields. Teams that do not use the masking utility, or that run a version outside that range, can skip it.
No product ranges from the sources yet.
pip show aws-lambda-powertools and see whether it falls between 3.6.0 and 3.34.0 inclusive.aws-lambda-powertools to 3.35.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
Bulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT
Description:
Powertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.
Impacted versions: >=3.6.0 AND <=3.34.0
Resolution:
This issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround available.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-104002")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.