Live › vulnerability › CVE-2026-119117
Amazon Kinesis Producer Library for Java writes the AWS credentials it resolved into log files at DEBUG log level, and passes them to its native child process as command-line arguments. A local user who can read those logs or the process argument list can obtain the application's AWS credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:36 UTC, 1h before NVD. All times on this page are UTC.
Applications that use the Kinesis Producer Library for Java at version 0.15.12 or below, or 1.x below 1.0.8, are exposed. Exposure needs a DEBUG-level Daemon logger that writes logs somewhere local users can read, or local access to the host where the native process runs. Teams running a fixed version, or with the Daemon logger held at INFO or higher and locked-down hosts, have less to worry about.
No product ranges from the sources yet.
com.amazonaws:amazon-kinesis-producer or software.amazon.kinesis:amazon-kinesis-producer in your build files, and confirm it is below 1.0.8.software.amazon.kinesis.producer.Daemon for 1.x, com.amazonaws.services.kinesis.producer.Daemon for 0.x) is set to DEBUG or lower in your logging configuration.software.amazon.kinesis:amazon-kinesis-producer to 1.0.8 or later.software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Bulletin ID: 2026-159-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 11:00 PM PDT
Description:
The Kinesis Producer Library (KPL) is an open-source Java library for writing data to Amazon Kinesis Data Streams at high throughput. KPL is a client library that runs inside the customer's application, in the customer's AWS account, using the customer's credentials.
We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.
To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Impacted versions:
Resolution:
This issue has been addressed in Amazon Kinesis Producer Library for Java (KPL) version 1.0.8. Version 0.x and 1.x users should upgrade to 1.0.8 or later.
Workarounds:
Upgrading to 1.0.8 or later is the only complete fix. Customers who cannot upgrade immediately can reduce risk as follows:
To stop credentials from being written to the log, make sure the Daemon logger is not configured at DEBUG log level or below. Set it explicitly to INFO or higher in the logging configuration, software.amazon.kinesis.producer.Daemon for 1.x and com.amazonaws.services.kinesis.producer.Daemon for 0.x, so that it stays above DEBUG log level even if the root logger is set to DEBUG. KPL's own LogLevel setting does not affect the Daemon logger. As a second layer, add a filter to the log pipeline that drops or redacts messages beginning "Starting Native Process"; secret scanners will likely not detect these values because they are hex-encoded.
No configuration removes the credentials from the native process's argument list in affected versions. To limit who can read it, run the producer on hosts or in containers with no untrusted local accounts.
Rotate long-lived keys, revoke active role sessions where needed, and redact or remove the affected logs. We recommend using short-lived IAM role credentials rather than long-lived access keys, and scoping the role to the minimal permissions the producer needs, such as kinesis:PutRecords and cloudwatch:PutMetricData on the specific stream and namespace Amazon Resource Names (ARNs).
These measures only prevent future disclosure of credentials; credentials already written to logs still need the above remediations.
References:
Acknowledgement:
We would like to thank Justin Capella from Keeper Security for collaborating on this issue through the coordinated disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-119117")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.