Live › vulnerability › GHSA-q3x5-q6rm-c7p3
Go to dashboardAWS Tools for PowerShell V5 up to 5.0.305 can write an IAM user's cleartext AWS Management Console password into command output and log artifacts. A local user who can read those logs or output can recover the password and sign in as that IAM user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC. All times on this page are UTC.
Teams that run AWS Tools for PowerShell V5 at version 5.0.305 or earlier on workstations, build agents or admin hosts where local users can read command output or log files. Exposure depends on using the affected -WhatIf or -Confirm pattern with sensitive arguments. Teams on 5.0.306 or later, or who do not use PowerShell for AWS, can skip it.
No product ranges from the sources yet.
Get-Module -ListAvailable AWSPowerShell.NetCore, AWS.Tools.Common or (Get-Module AWS.Tools.Common).Version and compare against 5.0.306-WhatIf or -Confirm with cmdlets that take passwords or other sensitive arguments, such as IAM login profile calls5.0.306 or later-WhatIf and -Confirm with cmdlets that carry sensitive argumentsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell
Bulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT
Description:
AWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.
Impacted versions: <= v5.0.305
Resolution:
This issue has been addressed in 5.0.306 version. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Avoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in its arguments when using AWS Tools for PowerShell in versions <= 5.0.305.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-q3x5-q6rm-c7p3")