Sensitive Information Exposure in Amazon Kinesis Producer Library for Java

CVE-2026-119117

What is CVE-2026-119117?

In certain versions of the Amazon Kinesis Producer Library for Java, a misconfiguration at the DEBUG log level results in the unintended insertion of sensitive AWS credentials into log files. This scenario can leave the credentials vulnerable to access by local users. Additionally, affected versions transmit these credentials to native child processes as command-line arguments, leading to further exposure. It is crucial for users operating versions prior to 1.0.8 to upgrade immediately, rotate IAM user keys, and revise logging configurations to ensure sensitive information is not recorded. Transitioning from affected versions to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later is also recommended.

References