---
id: "GHSA-3vxg-4xv2-jfh5"
kind: "vulnerability"
aliases: ["GHSA-3vxg-4xv2-jfh5"]
title: "CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "lab-disclosure", "lambda", "package", "python", "serverless"]
not_affected_if: ["no-data-masking-use", "version-outside-range"]
published_at: null
first_seen_at: "2026-10-24T19:43:42+00:00"
updated_at: "2026-10-25T04:50:16+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/", "first_seen_at": "2026-10-24T19:43:42+00:00"}]
---

# CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

The data masking utility in Powertools for AWS Lambda (Python) fails open: when masking hits an error, it returns the original value instead of a masked one. An attacker who can read the application's logs or output can see sensitive field values the app meant to hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show aws-lambda-powertools` and see whether it falls in `>=3.6.0` and `<=3.34.0`
- Search the project's dependency lock files for `aws-lambda-powertools` at those versions
- Look for use of the data masking utility (`DataMasking`) in Lambda functions

## Fix

- Upgrade `aws-lambda-powertools` (Python) to `3.35.0` or later
- Patch any forked or copied code that derives from the affected utility

## Timeline

- 2026-10-24T19:43:42+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/ — AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

## Documents

- [advisory] AWS: CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) https://aws.amazon.com/security/security-bulletins/rss/2026-123-aws/

## From the sources

CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

### CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

Bulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT

Description:

Powertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We identified CVE-2026-104002, a fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python). This issue might allow actors to read sensitive field values that the application intended to mask.

Impacted versions: >=3.6.0 AND <=3.34.0

Resolution:

This issue has been addressed in Powertools for AWS Lambda (Python) version 3.35.0. Masking errors now raise a DataMaskingError exception instead of returning the original value. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround available.

References:

- CVE-2026-104002
- GHSA-3vxg-4xv2-jfh5

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_