{"id":"GHSA-q3x5-q6rm-c7p3","kind":"vulnerability","aliases":["GHSA-q3x5-q6rm-c7p3"],"related":[],"title":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell","description":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\n### CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\nBulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT\n\nDescription:\n\nAWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\nImpacted versions: <= v5.0.305\n\nResolution:\n\nThis issue has been addressed in 5.0.306 version. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nAvoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in its arguments when using AWS Tools for PowerShell in versions <= 5.0.305.\n\nReferences:\n\n- CVE-2026-107783\n- GHSA-q3x5-q6rm-c7p3\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS Tools for PowerShell V5 up to 5.0.305 can write an IAM user's cleartext AWS Management Console password into command output and log artifacts. A local user who can read those logs or output can recover the password and sign in as that IAM user.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admin-workstations","aws","ci-runners","lab-disclosure","package","powershell","windows"],"not_affected_if":["no-powershell-usage","no-whatif-or-confirm-with-sensitive-args","version-5.0.306-or-later"],"how_to_check":"- Run `Get-Module -ListAvailable AWSPowerShell.NetCore, AWS.Tools.Common` or `(Get-Module AWS.Tools.Common).Version` and compare against `5.0.306`\n- Check whether scripts use `-WhatIf` or `-Confirm` with cmdlets that take passwords or other sensitive arguments, such as IAM login profile calls","fix":"- Upgrade AWS Tools for PowerShell to `5.0.306` or later\n- Patch any forked or derivative copies of the module to include the fix\n- Until upgraded, avoid `-WhatIf` and `-Confirm` with cmdlets that carry sensitive arguments\n- If a password may have been exposed, reset the affected IAM user's console password","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T04:51:27+00:00","updated_at":"2026-10-26T03:43:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:51:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AWS Tools for PowerShell to `5.0.306` or later\n- Patch any forked or derivative copies of the module to include the fix\n- Until upgraded, avoid `-WhatIf` and `-Confirm` with cmdlets that carry sensitive arguments\n- If a password may have been exposed, reset the affected IAM user's console password","reach":"local","title":"AWS Tools for PowerShell: IAM console passwords written to logs and output","impact":"high","summary":"AWS Tools for PowerShell V5 up to 5.0.305 can write an IAM user's cleartext AWS Management Console password into command output and log artifacts. A local user who can read those logs or output can recover the password and sign in as that IAM user.","category":"package","nicknames":[],"who_cares":["aws","powershell","windows","ci-runners","admin-workstations"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local users recover IAM console passwords from logs and output","analyst_note":"","how_to_check":"- Run `Get-Module -ListAvailable AWSPowerShell.NetCore, AWS.Tools.Common` or `(Get-Module AWS.Tools.Common).Version` and compare against `5.0.306`\n- Check whether scripts use `-WhatIf` or `-Confirm` with cmdlets that take passwords or other sensitive arguments, such as IAM login profile calls","needs_analyst":false,"not_affected_if":["version-5.0.306-or-later","no-powershell-usage","no-whatif-or-confirm-with-sensitive-args"],"who_is_affected":"Teams that run AWS Tools for PowerShell V5 at version 5.0.305 or earlier on workstations, build agents or admin hosts where local users can read command output or log files. Exposure depends on using the affected -WhatIf or -Confirm pattern with sensitive arguments. Teams on 5.0.306 or later, or who do not use PowerShell for AWS, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":3764,"output_tokens":725,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107783':3A,87C,102C,157C,253C '-132':118C '-2026':2A,86C,101C,156C,252C '08':130C '10/09/2026':129C '2026':117C '30':131C '5.0.305':46B,249C '5.0.306':172C,204C 'address':202C 'admin':27B 'admin-workst':26B 'administr':143C 'allow':174C 'argument':240C 'artifact':63B,193C 'attent':126C 'avoid':228C 'aw':12A,29B,39B,54B,96C,111C,119C,121C,135C,146C,167C,184C,243C 'aws-security@amazon.com':261C 'bulletin':115C 'c7p3':20A,25A,258C 'ci':31B 'ci-runn':30B 'cleartext':53B,183C 'cmdlet':233C 'code':219C 'command':59B,189C 'concern':267C 'confirm':231C 'consol':56B,186C 'contain':235C 'content':122C 'cve':1A,85C,100C,155C,251C 'date':128C 'deriv':218C 'descript':134C 'develop':141C 'disclosur':35B 'email':260C 'ensur':214C 'environ':152C 'file':10A,94C,109C,165C 'fix':226C 'fork':216C 'ghsa':17A,22A,255C 'ghsa-q3x5-q6rm-c7p3':16A,21A,254C 'iam':50B,83B,180C 'id':116C 'identifi':154C 'impact':194C 'import':124C 'incorpor':223C 'inform':7A,91C,106C,162C,237C 'insert':4A,88C,103C,159C 'issu':199C 'lab':34B 'lab-disclosur':33B 'latest':211C 'let':140C 'local':65B,175C 'log':9A,62B,71B,93C,108C,164C,192C 'manag':55B,144C,185C 'might':173C 'new':225C 'output':60B,73B,190C 'packag':36B 'password':57B,77B,187C 'patch':221C 'pdt':133C 'pleas':259C 'powershel':15A,37B,42B,99C,114C,138C,150C,170C,246C 'public':127C 'q3x5':18A,23A,256C 'q6rm':19A,24A,257C 'question':265C 'read':69B 'recommend':207C 'recov':75B,178C 'refer':250C 'requir':125C 'resolut':197C 'runner':32B 'scope':120C 'script':151C 'secur':264C 'sensit':6A,90C,105C,161C,236C 'servic':147C 'sign':79B 'tool':13A,40B,97C,112C,136C,168C,244C 'type':123C 'upgrad':208C 'use':229C,242C 'user':51B,66B,84B,176C,181C 'v5':43B,139C 'v5.0.305':196C 'version':195C,205C,212C,248C 'whatif':230C 'window':38B 'workaround':227C 'workstat':28B 'write':48B","nicknames":[],"mitigations":[{"kind":"workaround","scope":"AWS Tools for PowerShell <= 5.0.305","since":null,"covers":"Cmdlets that take sensitive information in their arguments, when run with -WhatIf or -Confirm, which would otherwise write the sensitive values to logs and command output","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/","vendor":"Team","seen_at":"2026-10-26T03:43:57Z","confidence":0.8,"source_title":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell","customer_action":"Avoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in their arguments until upgraded to 5.0.306"}],"who_affected":"Teams that run AWS Tools for PowerShell V5 at version 5.0.305 or earlier on workstations, build agents or admin hosts where local users can read command output or log files. Exposure depends on using the affected -WhatIf or -Confirm pattern with sensitive arguments. Teams on 5.0.306 or later, or who do not use PowerShell for AWS, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/#GHSA-q3x5-q6rm-c7p3","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-26T03:45:07+00:00","note":"AWS: CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell"}],"documents":[{"id":2946,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/","title":"AWS: CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell","kind":"advisory","source":"lab","text":"CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\n### CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell\n\nBulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT\n\nDescription:\n\nAWS Tools for PowerShell V5 lets developers and administrators manage their AWS services from the PowerShell scripting environment. We identified CVE-2026-107783, where insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\nImpacted versions: <= v5.0.305\n\nResolution:\n\nThis issue has been addressed in 5.0.306 version. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nAvoid using -WhatIf / -Confirm with cmdlets that contain sensitive information in its arguments when using AWS Tools for PowerShell in versions <= 5.0.305.\n\nReferences:\n\n- CVE-2026-107783\n- GHSA-q3x5-q6rm-c7p3\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}