{"id":"GHSA-3vxg-4xv2-jfh5","kind":"vulnerability","aliases":["GHSA-3vxg-4xv2-jfh5"],"related":[],"title":"CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)","description":"CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\n### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\nBulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT\n\nDescription:\n\nPowertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.\n\nImpacted versions: >=3.6.0 AND <=3.34.0\n\nResolution:\n\nThis issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-104002\n- GHSA-3vxg-4xv2-jfh5\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The data masking utility in Powertools for AWS Lambda (Python) fails open: when masking hits an error, it returns the original value instead of a masked one. An attacker who can read the application's logs or output can see sensitive field values the app meant to hide.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","lambda","package","python","serverless"],"not_affected_if":["no-data-masking-use","version-outside-range"],"how_to_check":"- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls in `>=3.6.0` and `<=3.34.0`\n- Search the project's dependency lock files for `aws-lambda-powertools` at those versions\n- Look for use of the data masking utility (`DataMasking`) in Lambda functions","fix":"- Upgrade `aws-lambda-powertools` (Python) to `3.35.0` or later\n- Patch any forked or copied code that derives from the affected utility","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:43:42+00:00","triaged_at":"2026-10-25T04:50:16+00:00","updated_at":"2026-10-25T04:50:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:50:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `aws-lambda-powertools` (Python) to `3.35.0` or later\n- Patch any forked or copied code that derives from the affected utility","reach":"unknown","title":"Powertools for AWS Lambda (Python): masking errors leak fields meant to be hidden","impact":"medium","summary":"The data masking utility in Powertools for AWS Lambda (Python) fails open: when masking hits an error, it returns the original value instead of a masked one. An attacker who can read the application's logs or output can see sensitive field values the app meant to hide.","category":"package","nicknames":[],"who_cares":["aws","lambda","python","serverless"],"confidence":0.7,"needs_auth":"unknown","worst_case":"sensitive masked fields are exposed in plain text to readers","analyst_note":"Confirm the exact trigger conditions for the masking error and whether an attacker can induce it, via the AWS bulletin 2026-123-AWS and the upstream GHSA-3vxg-4xv2-jfh5 advisory.","how_to_check":"- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls in `>=3.6.0` and `<=3.34.0`\n- Search the project's dependency lock files for `aws-lambda-powertools` at those versions\n- Look for use of the data masking utility (`DataMasking`) in Lambda functions","needs_analyst":true,"not_affected_if":["version-outside-range","no-data-masking-use"],"who_is_affected":"Teams running AWS Lambda functions in Python that use the Powertools data masking utility to hide sensitive fields, with a version in the affected range. Applications that do not use the masking utility, or that run a version outside the range, are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":3769,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104002':3A,88C,107C,166C,263C '-123':127C '-2026':2A,87C,106C,165C,262C '00':140C '10/01/2026':138C '14':139C '2026':126C '3.34.0':205C '3.35.0':219C '3.6.0':203C '3vxg':22A,27A,266C '4xv2':23A,28A,267C 'actor':189C 'address':211C 'allow':188C 'app':82B 'applic':71B,197C 'attack':66B 'attent':135C 'avail':259C 'aw':17A,30B,45B,102C,121C,128C,130C,146C,182C,215C 'aws-security@amazon.com':271C 'best':156C 'bulletin':124C 'code':246C 'concern':277C 'content':131C 'cve':1A,86C,105C,164C,261C 'data':11A,39B,96C,115C,176C 'datamaskingerror':225C 'date':137C 'deriv':245C 'descript':143C 'develop':151C,160C 'disclosur':33B 'email':270C 'ensur':241C 'error':7A,54B,92C,111C,171C,221C 'except':226C 'fail':5A,48B,90C,109C,169C 'fail-open':4A,89C,108C,168C 'field':79B,193C 'fix':253C 'fork':243C 'ghsa':21A,26A,265C 'ghsa-3vxg-4xv2-jfh5':20A,25A,264C 'handl':8A,93C,112C,172C 'hide':85B 'hit':52B 'id':125C 'identifi':163C 'impact':201C 'implement':154C 'import':133C 'incorpor':250C 'increas':159C 'instead':60B,227C 'intend':198C 'issu':173C,186C,208C 'jfh5':24A,29A,268C 'lab':32B 'lab-disclosur':31B 'lambda':18A,34B,46B,103C,122C,147C,183C,216C 'latest':238C 'log':73B 'mask':12A,40B,51B,63B,97C,116C,177C,200C,220C 'meant':83B 'might':187C 'new':252C 'one':64B 'open':6A,49B,91C,110C,170C 'origin':58B,231C 'output':75B 'packag':35B 'patch':248C 'pdt':142C 'pleas':269C 'pm':141C 'powertool':15A,43B,100C,119C,144C,180C,213C 'practic':157C 'public':136C 'python':19A,36B,47B,104C,123C,148C,184C,217C 'question':275C 'rais':223C 'read':69B,191C 'recommend':234C 'refer':260C 'requir':134C 'resolut':206C 'return':56B,229C 'scope':129C 'secur':274C 'see':77B 'sensit':78B,192C 'serverless':37B,155C 'toolkit':152C 'type':132C 'upgrad':235C 'util':13A,41B,98C,117C,178C 'valu':59B,80B,194C,232C 'veloc':161C 'version':202C,218C,239C 'within':174C 'workaround':254C,258C","nicknames":[],"mitigations":[],"who_affected":"Teams running AWS Lambda functions in Python that use the Powertools data masking utility to hide sensitive fields, with a version in the affected range. Applications that do not use the masking utility, or that run a version outside the range, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/#GHSA-3vxg-4xv2-jfh5","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:42+00:00","fetched_at":"2026-10-24T19:43:42+00:00","note":"AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)"}],"documents":[{"id":2958,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/","title":"AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)","kind":"advisory","source":"lab","text":"CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\n### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)\n\nBulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT\n\nDescription:\n\nPowertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.\n\nImpacted versions: >=3.6.0 AND <=3.34.0\n\nResolution:\n\nThis issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-104002\n- GHSA-3vxg-4xv2-jfh5\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}