Live › vulnerability › GHSA-3vxg-4xv2-jfh5
Go to dashboardThe data masking utility in Powertools for AWS Lambda (Python) fails open: when masking hits an error, it returns the original value instead of a masked one. An attacker who can read the application's logs or output can see sensitive field values the app meant to hide.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC. All times on this page are UTC.
Teams running AWS Lambda functions in Python that use the Powertools data masking utility to hide sensitive fields, with a version in the affected range. Applications that do not use the masking utility, or that run a version outside the range, are not affected.
No product ranges from the sources yet.
pip show aws-lambda-powertools and see whether it falls in >=3.6.0 and <=3.34.0aws-lambda-powertools at those versionsDataMasking) in Lambda functionsaws-lambda-powertools (Python) to 3.35.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
Bulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT
Description:
Powertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.
Impacted versions: >=3.6.0 AND <=3.34.0
Resolution:
This issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround available.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-3vxg-4xv2-jfh5")