Bulletin ID: 2026-159-AWS
Publication Date: 10/30/2026 11:00 AM PDT
Description:
We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.
Impacted versions:
– com.amazonaws:amazon-kinesis-producer <= 0.15.12
– oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.