{"id":"CVE-2026-107783","kind":"vulnerability","aliases":["CVE-2026-107783"],"related":[],"title":"AWS Tools for PowerShell: logs leak IAM users' console passwords to local users","description":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\n### CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\nBulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT\n\nDescription:\n\nAWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\nImpacted versions: <= v5.0.305\n\nResolution:\n\nThis issue has been addressed in 5.0.306 version. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nAvoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in its arguments when using AWS Tools for PowerShell in versions <= 5.0.305.\n\nReferences:\n\n- CVE-2026-107783\n- GHSA-q3x5-q6rm-c7p3\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS Tools for PowerShell before 5.0.306 writes sensitive arguments into command output and log files. A local user on the same machine can recover an IAM user's cleartext AWS Management Console password.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","linux","package","powershell","windows"],"not_affected_if":["no-powershell-module","version-5.0.306-or-later"],"how_to_check":"- Check the installed module version with `Get-Module -ListAvailable AWSPowerShell.NetCore` or `Get-Module -ListAvailable AWS.Tools.Common` and compare against `5.0.306`.\n- Review PowerShell transcript and log files on shared machines for console passwords passed to cmdlets.","fix":"- Upgrade AWS Tools for PowerShell to `5.0.306` or later.\n- Patch any forked or derivative code that copies the affected logging behaviour.\n- Until upgraded, avoid `-WhatIf` and `-Confirm` with cmdlets that take sensitive arguments.","status":"open","published_at":"2026-10-09T16:17:24+00:00","first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T03:46:46+00:00","updated_at":"2026-10-25T03:46:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:46:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AWS Tools for PowerShell to `5.0.306` or later.\n- Patch any forked or derivative code that copies the affected logging behaviour.\n- Until upgraded, avoid `-WhatIf` and `-Confirm` with cmdlets that take sensitive arguments.","reach":"local","title":"AWS Tools for PowerShell: logs leak IAM users' console passwords to local users","impact":"medium","summary":"AWS Tools for PowerShell before 5.0.306 writes sensitive arguments into command output and log files. A local user on the same machine can recover an IAM user's cleartext AWS Management Console password.","category":"package","nicknames":[],"who_cares":["aws","powershell","windows","linux"],"confidence":0.8,"needs_auth":"yes","worst_case":"local user recovers IAM console password from logs","analyst_note":"","how_to_check":"- Check the installed module version with `Get-Module -ListAvailable AWSPowerShell.NetCore` or `Get-Module -ListAvailable AWS.Tools.Common` and compare against `5.0.306`.\n- Review PowerShell transcript and log files on shared machines for console passwords passed to cmdlets.","needs_analyst":false,"not_affected_if":["version-5.0.306-or-later","no-powershell-module"],"who_is_affected":"Teams that run AWS Tools for PowerShell version 5.0.305 or earlier, especially on shared or multi-user machines where logs or transcripts can be read. Systems that do not use the module, or run only later versions, are not affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3788,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107783':16A,19A,63C,78C,133C,229C '-132':94C '-2026':15A,18A,62C,77C,132C,228C '08':106C '10/09/2026':105C '2026':93C '30':107C '5.0.305':225C '5.0.306':33B,148C,180C 'address':178C 'administr':119C 'allow':150C 'argument':36B,216C 'artifact':169C 'attent':102C 'avoid':204C 'aw':1A,20B,28B,57B,72C,87C,95C,97C,111C,122C,143C,160C,219C 'aws-security@amazon.com':237C 'bulletin':91C 'c7p3':234C 'cleartext':56B,159C 'cmdlet':209C 'code':195C 'command':38B,165C 'concern':243C 'confirm':207C 'consol':9A,59B,162C 'contain':211C 'content':98C 'cve':14A,17A,61C,76C,131C,227C 'date':104C 'deriv':194C 'descript':110C 'develop':117C 'disclosur':23B 'email':236C 'ensur':190C 'environ':128C 'file':42B,70C,85C,141C 'fix':202C 'fork':192C 'ghsa':231C 'ghsa-q3x5-q6rm-c7p3':230C 'iam':7A,53B,156C 'id':92C 'identifi':130C 'impact':170C 'import':100C 'incorpor':199C 'inform':67C,82C,138C,213C 'insert':64C,79C,135C 'issu':175C 'lab':22B 'lab-disclosur':21B 'latest':187C 'leak':6A 'let':116C 'linux':24B 'local':12A,44B,151C 'log':5A,41B,69C,84C,140C,168C 'machin':49B 'manag':58B,120C,161C 'might':149C 'new':201C 'output':39B,166C 'packag':25B 'password':10A,60B,163C 'patch':197C 'pdt':109C 'pleas':235C 'powershel':4A,26B,31B,75C,90C,114C,126C,146C,222C 'public':103C 'q3x5':232C 'q6rm':233C 'question':241C 'recommend':183C 'recov':51B,154C 'refer':226C 'requir':101C 'resolut':173C 'scope':96C 'script':127C 'secur':240C 'sensit':35B,66C,81C,137C,212C 'servic':123C 'tool':2A,29B,73C,88C,112C,144C,220C 'type':99C 'upgrad':184C 'use':205C,218C 'user':8A,13A,45B,54B,152C,157C 'v5':115C 'v5.0.305':172C 'version':171C,181C,188C,224C 'whatif':206C 'window':27B 'workaround':203C 'write':34B","nicknames":[],"mitigations":[],"who_affected":"Teams that run AWS Tools for PowerShell version 5.0.305 or earlier, especially on shared or multi-user machines where logs or transcripts can be read. Systems that do not use the module, or run only later versions, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/#CVE-2026-107783","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-24T19:28:15+00:00","note":"AWS: CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell"},{"source":"nvd","external_id":"CVE-2026-107783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107783","severity":null,"published_at":"2026-10-09T16:17:24+00:00","modified_at":"2026-10-09T18:17:02+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null}],"documents":[{"id":2946,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/","title":"AWS: CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell","kind":"advisory","source":"lab","text":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\n### CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\nBulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT\n\nDescription:\n\nAWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\nImpacted versions: <= v5.0.305\n\nResolution:\n\nThis issue has been addressed in 5.0.306 version. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nAvoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in its arguments when using AWS Tools for PowerShell in versions <= 5.0.305.\n\nReferences:\n\n- CVE-2026-107783\n- GHSA-q3x5-q6rm-c7p3\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}