LOWVulnerability
Global

CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

·Source: AWS Security Bulletins

Updated:

Executive Summary

Bulletin ID: 2026-159-AWS Publication Date: 10/30/2026 11:00 AM PDT Description: We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolve

Analysis

Bulletin ID: 2026-159-AWS Publication Date: 10/30/2026 11:00 AM PDT Description: We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. Impacted versions: - com.amazonaws:amazon-kinesis-producer - oftware.amazon.kinesis:amazon-kinesis-producer Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Indicators of Compromise (3)

CVE (1)
CVE-2026-119117
NVDMITRE CVE
URL (1)
https://aws.amazon.com/security/security-bulletins/2026-159-aws/
VirusTotalURLhaus
Domain (1)
aws.amazon.com
VirusTotalURLhaus
Source Attribution

Originally published by AWS Security Bulletins on Oct 30, 2026.

Related Threats

MEDIUMVulnerability

Fashion retailer Resolve says hackers stole payment card information

The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.

The Record
MEDIUMVulnerability

PE firm CD&R targets buyout of $40bn Global Payments - FT

Global Payments, the payments processor with an enterprise value of around $40 billion, is an acquisition target for private equity firm CD&R, according to the Financial Times.

Finextra
MEDIUMVulnerability

Apple notifications alert victims in 99 countries about mercenary spyware infections

The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop .

CyberScoop