{"id":"GHSA-mr97-jq69-qr5f","kind":"vulnerability","aliases":["GHSA-mr97-jq69-qr5f"],"related":[],"title":"CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java","description":"CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java\n\n### CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java\n\nBulletin ID: 2026-159-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 11:00 PM PDT\n\nDescription:\n\nThe Kinesis Producer Library (KPL) is an open-source Java library for writing data to Amazon Kinesis Data Streams at high throughput. KPL is a client library that runs inside the customer's application, in the customer's AWS account, using the customer's credentials.\n\nWe published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.\n\nTo remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.\n\nImpacted versions:\n\n- com.amazonaws:amazon-kinesis-producer <= 0.15.12\n- oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8\n\nResolution:\n\nThis issue has been addressed in Amazon Kinesis Producer Library for Java (KPL) version 1.0.8. Version 0.x and 1.x users should upgrade to 1.0.8 or later.\n\nWorkarounds:\n\nUpgrading to 1.0.8 or later is the only complete fix. Customers who cannot upgrade immediately can reduce risk as follows:\n\nTo stop credentials from being written to the log, make sure the Daemon logger is not configured at DEBUG log level or below. Set it explicitly to INFO or higher in the logging configuration, software.amazon.kinesis.producer.Daemon for 1.x and com.amazonaws.services.kinesis.producer.Daemon for 0.x, so that it stays above DEBUG log level even if the root logger is set to DEBUG. KPL's own LogLevel setting does not affect the Daemon logger. As a second layer, add a filter to the log pipeline that drops or redacts messages beginning \"Starting Native Process\"; secret scanners will likely not detect these values because they are hex-encoded.\n\nNo configuration removes the credentials from the native process's argument list in affected versions. To limit who can read it, run the producer on hosts or in containers with no untrusted local accounts.\n\nRotate long-lived keys, revoke active role sessions where needed, and redact or remove the affected logs. We recommend using short-lived IAM role credentials rather than long-lived access keys, and scoping the role to the minimal permissions the producer needs, such as kinesis:PutRecords and cloudwatch:PutMetricData on the specific stream and namespace Amazon Resource Names (ARNs).\n\nThese measures only prevent future disclosure of credentials; credentials already written to logs still need the above remediations.\n\nReferences:\n\n- CVE-2026-119117\n- GHSA-mr97-jq69-qr5f\n- Revoke IAM role temporary security credentials\n\nAcknowledgement:\n\nWe would like to thank Justin Capella from Keeper Security for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The Amazon Kinesis Producer Library for Java writes the AWS credentials it resolves into debug logs and passes them as command-line arguments to its native child process. A local user who can read those logs or the process argument list can obtain the credentials and act with the application's AWS permissions.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","java","kinesis","kpl","lab-disclosure","package","self-hosted"],"not_affected_if":["daemon-logger-above-debug","no-untrusted-local-accounts","upgraded-to-1.0.8"],"how_to_check":"- Check the version of `com.amazonaws:amazon-kinesis-producer` or `software.amazon.kinesis:amazon-kinesis-producer` in your build files; versions at or below `0.15.12` (com.amazonaws) or below `1.0.8` (software.amazon.kinesis) are affected.\n- Check whether the Daemon logger is set to DEBUG or lower in your logging configuration (`software.amazon.kinesis.producer.Daemon` or `com.amazonaws.services.kinesis.producer.Daemon`).\n- Search existing logs for lines beginning \"Starting Native Process\" that contain credential values.","fix":"- `software.amazon.kinesis:amazon-kinesis-producer` `1.0.8` or later\n- 0.x users should migrate to `software.amazon.kinesis:amazon-kinesis-producer` `1.0.8` or later","status":"open","published_at":"2026-10-30T00:00:00+00:00","first_seen_at":"2026-10-30T18:36:53+00:00","triaged_at":"2026-10-30T18:37:54+00:00","updated_at":"2026-10-30T18:37:54+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T18:37:54Z","model":"claude-haiku-5-5","output":{"fix":"- `software.amazon.kinesis:amazon-kinesis-producer` `1.0.8` or later\n- 0.x users should migrate to `software.amazon.kinesis:amazon-kinesis-producer` `1.0.8` or later","reach":"local","title":"Kinesis Producer Library for Java: AWS credentials leak into logs and process lists","impact":"high","summary":"The Amazon Kinesis Producer Library for Java writes the AWS credentials it resolves into debug logs and passes them as command-line arguments to its native child process. A local user who can read those logs or the process argument list can obtain the credentials and act with the application's AWS permissions.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","aws","kinesis","kpl","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads AWS credentials from logs or process arguments","analyst_note":"","how_to_check":"- Check the version of `com.amazonaws:amazon-kinesis-producer` or `software.amazon.kinesis:amazon-kinesis-producer` in your build files; versions at or below `0.15.12` (com.amazonaws) or below `1.0.8` (software.amazon.kinesis) are affected.\n- Check whether the Daemon logger is set to DEBUG or lower in your logging configuration (`software.amazon.kinesis.producer.Daemon` or `com.amazonaws.services.kinesis.producer.Daemon`).\n- Search existing logs for lines beginning \"Starting Native Process\" that contain credential values.","plain_action":"","needs_analyst":false,"not_affected_if":["upgraded-to-1.0.8","no-untrusted-local-accounts","daemon-logger-above-debug"],"who_is_affected":"Applications that use the Kinesis Producer Library for Java in an affected version are exposed, most seriously where the Daemon logger runs at DEBUG level and where untrusted local accounts can read logs or the process list on the same host or container. Teams that run the producer only on locked-down hosts with INFO-or-higher logging have a lower risk, but credentials already written to logs still need rotation.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000935,"input_tokens":5392,"output_tokens":791,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119117':3A,101C,124C,215C,628C '-159':148C '-2026':2A,100C,123C,214C,627C '0':328C,373C,447C '0.15.12':349C '00':161C '1':376C,442C '1.0.8':232C,300C,339C,355C,371C,382C,388C '10/30/2026':159C '11':160C '2026':147C 'access':577C 'account':205C,544C 'acknowledg':640C 'act':92B 'activ':312C,551C 'add':481C 'address':361C 'affect':261C,326C,473C,524C,561C 'allow':245C 'alreadi':616C 'amazon':18A,46B,116C,139C,181C,225C,336C,346C,352C,363C,603C 'amazon-kinesis-produc':335C,345C,351C 'applic':95B,199C,259C 'argument':14A,68B,85B,112C,135C,278C,289C,521C 'arn':606C 'attent':156C 'aw':34B,54B,97B,149C,151C,204C,251C 'aws-security@amazon.com':663C 'begin':493C 'bulletin':145C 'cannot':398C 'capella':647C 'child':72B,272C 'client':191C 'cloudwatch':595C 'collabor':652C 'com.amazonaws':344C 'com.amazonaws.services.kinesis.producer.daemon':445C 'command':66B,276C 'command-lin':65B,275C 'complet':394C 'concern':669C 'configur':239C,422C,439C,512C 'contain':539C 'content':152C 'coordin':658C 'credenti':55B,90B,210C,252C,268C,408C,515C,571C,614C,615C,639C 'custom':197C,202C,208C,396C 'cve':1A,99C,122C,213C,626C 'daemon':418C,475C 'data':179C,183C,322C 'date':158C 'debug':59B,241C,424C,454C,465C 'descript':164C 'detect':502C 'disclosur':40B,612C,659C 'drop':489C 'email':662C 'encod':510C 'even':457C 'explicit':431C 'file':11A,109C,132C,223C 'filter':483C 'fix':395C 'follow':405C 'futur':611C 'ghsa':25A,30A,630C 'ghsa-mr97-jq69-qr5f':24A,29A,629C 'hex':509C 'hex-encod':508C 'high':186C 'higher':435C 'host':44B,536C 'iam':308C,569C,635C 'id':146C 'immedi':400C 'impact':342C 'import':154C 'info':433C 'inform':7A,105C,128C,219C 'insert':4A,102C,125C,216C 'insid':195C 'issu':294C,358C,655C 'java':23A,35B,51B,121C,144C,175C,230C,368C 'jq69':27A,32A,632C 'justin':646C 'keeper':649C 'key':310C,549C,578C 'kinesi':19A,36B,47B,117C,140C,166C,182C,226C,337C,347C,353C,364C,592C 'kpl':37B,169C,188C,369C,466C 'lab':39B 'lab-disclosur':38B 'later':302C,341C,384C,390C 'layer':480C 'level':243C,426C,456C 'librari':21A,49B,119C,142C,168C,176C,192C,228C,235C,255C,265C,366C 'like':500C,643C 'limit':527C 'line':67B,277C 'list':15A,86B,113C,136C,290C,522C 'live':548C,568C,576C 'local':75B,246C,281C,543C 'log':10A,60B,81B,108C,131C,222C,242C,321C,414C,425C,438C,455C,486C,562C,619C 'logger':237C,419C,461C,476C 'loglevel':469C 'long':306C,547C,575C 'long-liv':546C,574C 'long-term':305C 'make':415C 'measur':608C 'messag':492C 'might':244C 'migrat':332C 'minim':585C 'mr97':26A,31A,631C 'name':605C 'namespac':602C 'nativ':71B,271C,495C,518C 'need':316C,555C,589C,621C 'obtain':88B,249C 'oftware.amazon.kinesis':350C 'open':173C 'open-sourc':172C 'packag':41B 'pass':62B,266C 'pdt':163C 'permiss':98B,586C 'pipelin':487C 'pleas':661C 'pm':162C 'prevent':610C 'process':13A,73B,84B,111C,134C,273C,288C,496C,519C,660C 'produc':20A,48B,118C,141C,167C,227C,338C,348C,354C,365C,534C,588C 'public':157C 'publish':212C 'putmetricdata':596C 'putrecord':593C 'qr5f':28A,33A,633C 'question':667C 'rather':572C 'read':79B,284C,530C 'recommend':564C 'redact':320C,491C,557C 'reduc':402C 'refer':625C 'remedi':292C,624C 'remov':513C,559C 'requir':155C 'resolut':356C 'resolv':57B,256C 'resourc':604C 'restrict':318C 'revok':311C,550C,634C 'risk':403C 'role':313C,552C,570C,582C,636C 'root':460C 'rotat':303C,545C 'run':194C,532C 'scanner':498C 'scope':150C,580C 'second':479C 'secret':497C 'secur':638C,650C,666C 'self':43B 'self-host':42B 'sensit':6A,104C,127C,218C 'separ':260C 'session':314C,553C 'set':429C,463C,470C 'short':567C 'short-liv':566C 'software.amazon.kinesis':334C 'software.amazon.kinesis.producer.daemon':440C 'sourc':174C 'specif':599C 'start':494C 'stay':452C 'still':620C 'stop':407C 'stream':184C,600C 'sure':416C 'temporari':637C 'term':307C 'thank':645C 'throughput':187C 'type':153C 'untrust':542C 'upgrad':297C,380C,386C,399C 'use':206C,565C 'user':76B,247C,282C,295C,309C,330C,378C 'valu':504C 'version':262C,299C,327C,343C,370C,372C,525C 'workaround':385C 'would':642C 'write':52B,178C 'written':323C,411C,617C 'x':329C,374C,377C,443C,448C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Kinesis Producer Library for Java in an affected version are exposed, most seriously where the Daemon logger runs at DEBUG level and where untrusted local accounts can read logs or the process list on the same host or container. Teams that run the producer only on locked-down hosts with INFO-or-higher logging have a lower risk, but credentials already written to logs still need rotation.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-159-aws/#GHSA-mr97-jq69-qr5f","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-159-aws/","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T18:36:53+00:00","fetched_at":"2026-10-30T18:36:53+00:00","note":"AWS: CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java"}],"documents":[{"id":25198,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-159-aws/","title":"AWS: CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java\n\n### CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java\n\nBulletin ID: 2026-159-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 11:00 PM PDT\n\nDescription:\n\nThe Kinesis Producer Library (KPL) is an open-source Java library for writing data to Amazon Kinesis Data Streams at high throughput. KPL is a client library that runs inside the customer's application, in the customer's AWS account, using the customer's credentials.\n\nWe published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.\n\nTo remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.\n\nImpacted versions:\n\n- com.amazonaws:amazon-kinesis-producer <= 0.15.12\n- oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8\n\nResolution:\n\nThis issue has been addressed in Amazon Kinesis Producer Library for Java (KPL) version 1.0.8. Version 0.x and 1.x users should upgrade to 1.0.8 or later.\n\nWorkarounds:\n\nUpgrading to 1.0.8 or later is the only complete fix. Customers who cannot upgrade immediately can reduce risk as follows:\n\nTo stop credentials from being written to the log, make sure the Daemon logger is not configured at DEBUG log level or below. Set it explicitly to INFO or higher in the logging configuration, software.amazon.kinesis.producer.Daemon for 1.x and com.amazonaws.services.kinesis.producer.Daemon for 0.x, so that it stays above DEBUG log level even if the root logger is set to DEBUG. KPL's own LogLevel setting does not affect the Daemon logger. As a second layer, add a filter to the log pipeline that drops or redacts messages beginning \"Starting Native Process\"; secret scanners will likely not detect these values because they are hex-encoded.\n\nNo configuration removes the credentials from the native process's argument list in affected versions. To limit who can read it, run the producer on hosts or in containers with no untrusted local accounts.\n\nRotate long-lived keys, revoke active role sessions where needed, and redact or remove the affected logs. We recommend using short-lived IAM role credentials rather than long-lived access keys, and scoping the role to the minimal permissions the producer needs, such as kinesis:PutRecords and cloudwatch:PutMetricData on the specific stream and namespace Amazon Resource Names (ARNs).\n\nThese measures only prevent future disclosure of credentials; credentials already written to logs still need the above remediations.\n\nReferences:\n\n- CVE-2026-119117\n- GHSA-mr97-jq69-qr5f\n- Revoke IAM role temporary security credentials\n\nAcknowledgement:\n\nWe would like to thank Justin Capella from Keeper Security for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-30T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}