---
id: "CVE-2026-104002"
kind: "vulnerability"
aliases: ["CVE-2026-104002"]
title: "Powertools for AWS Lambda (Python): masking errors leak sensitive values"
severity: "medium"
cvss: 6.0
epss: 0.00306
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "aws-lambda", "lab-disclosure", "package", "python", "serverless"]
not_affected_if: ["no-data-masking-use", "version-outside-range"]
published_at: "2026-10-01T22:17:00+00:00"
first_seen_at: "2026-10-24T19:43:42+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/", "first_seen_at": "2026-10-24T19:43:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104002", "first_seen_at": "2026-10-24T20:15:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-104002", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Powertools for AWS Lambda (Python): masking errors leak sensitive values

The data masking utility in Powertools for AWS Lambda (Python) returns the original value when masking fails instead of masking it. An actor who can read the function's output or logs can see field values the application meant to hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls between `3.6.0` and `3.34.0` inclusive.
- Search the code for uses of the data masking utility (DataMasking) and check whether any forked or vendored copy of the library is in use.

## Fix

- Upgrade `aws-lambda-powertools` to `3.35.0` or later.
- Patch any forked or derivative copy of the library to include the fix.
- There is no workaround.

## Timeline

- 2026-10-24T19:43:42+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/ — AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
- 2026-10-24T20:15:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104002
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-104002

## Documents

- [advisory] AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/

## From the sources

CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

Bulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT

Description:

Powertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.

Impacted versions: >=3.6.0 AND <=3.34.0

Resolution:

This issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround available.

References:

- CVE-2026-104002
- GHSA-3vxg-4xv2-jfh5

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_