Live › vulnerability › GHSA-mr97-jq69-qr5f
The Amazon Kinesis Producer Library for Java writes the AWS credentials it resolves into debug logs and passes them as command-line arguments to its native child process. A local user who can read those logs or the process argument list can obtain the credentials and act with the application's AWS permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:36 UTC. All times on this page are UTC.
Applications that use the Kinesis Producer Library for Java in an affected version are exposed, most seriously where the Daemon logger runs at DEBUG level and where untrusted local accounts can read logs or the process list on the same host or container. Teams that run the producer only on locked-down hosts with INFO-or-higher logging have a lower risk, but credentials already written to logs still need rotation.
No product ranges from the sources yet.
com.amazonaws:amazon-kinesis-producer or software.amazon.kinesis:amazon-kinesis-producer in your build files; versions at or below 0.15.12 (com.amazonaws) or below 1.0.8 (software.amazon.kinesis) are affected.software.amazon.kinesis.producer.Daemon or com.amazonaws.services.kinesis.producer.Daemon).software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or latersoftware.amazon.kinesis:amazon-kinesis-producer 1.0.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Bulletin ID: 2026-159-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 11:00 PM PDT
Description:
The Kinesis Producer Library (KPL) is an open-source Java library for writing data to Amazon Kinesis Data Streams at high throughput. KPL is a client library that runs inside the customer's application, in the customer's AWS account, using the customer's credentials.
We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.
To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Impacted versions:
Resolution:
This issue has been addressed in Amazon Kinesis Producer Library for Java (KPL) version 1.0.8. Version 0.x and 1.x users should upgrade to 1.0.8 or later.
Workarounds:
Upgrading to 1.0.8 or later is the only complete fix. Customers who cannot upgrade immediately can reduce risk as follows:
To stop credentials from being written to the log, make sure the Daemon logger is not configured at DEBUG log level or below. Set it explicitly to INFO or higher in the logging configuration, software.amazon.kinesis.producer.Daemon for 1.x and com.amazonaws.services.kinesis.producer.Daemon for 0.x, so that it stays above DEBUG log level even if the root logger is set to DEBUG. KPL's own LogLevel setting does not affect the Daemon logger. As a second layer, add a filter to the log pipeline that drops or redacts messages beginning "Starting Native Process"; secret scanners will likely not detect these values because they are hex-encoded.
No configuration removes the credentials from the native process's argument list in affected versions. To limit who can read it, run the producer on hosts or in containers with no untrusted local accounts.
Rotate long-lived keys, revoke active role sessions where needed, and redact or remove the affected logs. We recommend using short-lived IAM role credentials rather than long-lived access keys, and scoping the role to the minimal permissions the producer needs, such as kinesis:PutRecords and cloudwatch:PutMetricData on the specific stream and namespace Amazon Resource Names (ARNs).
These measures only prevent future disclosure of credentials; credentials already written to logs still need the above remediations.
References:
Acknowledgement:
We would like to thank Justin Capella from Keeper Security for collaborating on this issue through the coordinated disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-mr97-jq69-qr5f")