{"id":"CVE-2026-104002","kind":"vulnerability","aliases":["CVE-2026-104002"],"related":[],"title":"Powertools for AWS Lambda (Python): masking errors leak sensitive values","description":"CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\n### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\nBulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT\n\nDescription:\n\nPowertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.\n\nImpacted versions: >=3.6.0 AND <=3.34.0\n\nResolution:\n\nThis issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-104002\n- GHSA-3vxg-4xv2-jfh5\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The data masking utility in Powertools for AWS Lambda (Python) returns the original value when masking fails instead of masking it. An actor who can read the function's output or logs can see field values the application meant to hide.","severity":"medium","cvss":6.0,"epss":0.00306,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-lambda","lab-disclosure","package","python","serverless"],"not_affected_if":["no-data-masking-use","version-outside-range"],"how_to_check":"- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls between `3.6.0` and `3.34.0` inclusive.\n- Search the code for uses of the data masking utility (DataMasking) and check whether any forked or vendored copy of the library is in use.","fix":"- Upgrade `aws-lambda-powertools` to `3.35.0` or later.\n- Patch any forked or derivative copy of the library to include the fix.\n- There is no workaround.","status":"open","published_at":"2026-10-01T22:17:00+00:00","first_seen_at":"2026-10-24T19:43:42+00:00","triaged_at":"2026-10-25T04:07:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:07:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `aws-lambda-powertools` to `3.35.0` or later.\n- Patch any forked or derivative copy of the library to include the fix.\n- There is no workaround.","reach":"unknown","title":"Powertools for AWS Lambda (Python): masking errors leak sensitive values","impact":"medium","summary":"The data masking utility in Powertools for AWS Lambda (Python) returns the original value when masking fails instead of masking it. An actor who can read the function's output or logs can see field values the application meant to hide.","category":"package","nicknames":[],"who_cares":["python","aws-lambda","serverless"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Masked sensitive field values are readable in plain form","analyst_note":"","how_to_check":"- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls between `3.6.0` and `3.34.0` inclusive.\n- Search the code for uses of the data masking utility (DataMasking) and check whether any forked or vendored copy of the library is in use.","needs_analyst":false,"not_affected_if":["version-outside-range","no-data-masking-use"],"who_is_affected":"Applications that run Powertools for AWS Lambda (Python) between versions 3.6.0 and 3.34.0 and rely on its data masking utility to hide sensitive fields. Teams that do not use the masking utility, or that run a version outside that range, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3786,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104002':13A,16A,70C,89C,148C,245C '-123':109C '-2026':12A,15A,69C,88C,147C,244C '00':122C '10/01/2026':120C '14':121C '2026':108C '3.34.0':187C '3.35.0':201C '3.6.0':185C '3vxg':248C '4xv2':249C 'actor':49B,171C 'address':193C 'allow':170C 'applic':64B,179C 'attent':117C 'avail':241C 'aw':3A,17B,19B,34B,84C,103C,110C,112C,128C,164C,197C 'aws-lambda':18B 'aws-security@amazon.com':253C 'best':138C 'bulletin':106C 'code':228C 'concern':259C 'content':113C 'cve':11A,14A,68C,87C,146C,243C 'data':28B,78C,97C,158C 'datamaskingerror':207C 'date':119C 'deriv':227C 'descript':125C 'develop':133C,142C 'disclosur':23B 'email':252C 'ensur':223C 'error':7A,74C,93C,153C,203C 'except':208C 'fail':43B,72C,91C,151C 'fail-open':71C,90C,150C 'field':61B,175C 'fix':235C 'fork':225C 'function':54B 'ghsa':247C 'ghsa-3vxg-4xv2-jfh5':246C 'handl':75C,94C,154C 'hide':67B 'id':107C 'identifi':145C 'impact':183C 'implement':136C 'import':115C 'incorpor':232C 'increas':141C 'instead':44B,209C 'intend':180C 'issu':155C,168C,190C 'jfh5':250C 'lab':22B 'lab-disclosur':21B 'lambda':4A,20B,35B,85C,104C,129C,165C,198C 'latest':220C 'leak':8A 'log':58B 'mask':6A,29B,42B,46B,79C,98C,159C,182C,202C 'meant':65B 'might':169C 'new':234C 'open':73C,92C,152C 'origin':39B,213C 'output':56B 'packag':24B 'patch':230C 'pdt':124C 'pleas':251C 'pm':123C 'powertool':1A,32B,82C,101C,126C,162C,195C 'practic':139C 'public':118C 'python':5A,25B,36B,86C,105C,130C,166C,199C 'question':257C 'rais':205C 'read':52B,173C 'recommend':216C 'refer':242C 'requir':116C 'resolut':188C 'return':37B,211C 'scope':111C 'secur':256C 'see':60B 'sensit':9A,174C 'serverless':26B,137C 'toolkit':134C 'type':114C 'upgrad':217C 'util':30B,80C,99C,160C 'valu':10A,40B,62B,176C,214C 'veloc':143C 'version':184C,200C,221C 'within':156C 'workaround':236C,240C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Powertools for AWS Lambda (Python) between versions 3.6.0 and 3.34.0 and rely on its data masking utility to hide sensitive fields. Teams that do not use the masking utility, or that run a version outside that range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T22:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/#CVE-2026-104002","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:42+00:00","fetched_at":"2026-10-24T19:43:42+00:00","note":"AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)"},{"source":"nvd","external_id":"CVE-2026-104002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104002","severity":null,"published_at":"2026-10-01T22:17:00+00:00","modified_at":"2026-10-02T19:16:40+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-104002","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104002","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2958,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/","title":"AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)","kind":"advisory","source":"lab","text":"CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\n### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\nBulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT\n\nDescription:\n\nPowertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.\n\nImpacted versions: >=3.6.0 AND <=3.34.0\n\nResolution:\n\nThis issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-104002\n- GHSA-3vxg-4xv2-jfh5\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}