CVE-2026-119117: Amazon Kinesis Producer Library for Java credential logging

CVE-2026-119117 · Severity: high · CVSS 6.5 · Published 2026-10-30

The Amazon Kinesis Producer Library for Java is a client library that writes data to Amazon Kinesis Data Streams. When configured at DEBUG log level, the library leaks AWS credentials in log files, and also passes credentials to a native child process as command-line arguments where local users can read them. An attacker with local access to the machine can steal AWS credentials and take over the associated AWS account.

Technologies: Amazon AWS. Vendors: Amazon.

Quick answers

Is CVE-2026-119117 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-119117 being exploited in the wild.
How severe is CVE-2026-119117?
High severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?
Amazon Kinesis Producer Library for Java com.amazonaws:amazon-kinesis-producer <= 0.15.12; software.amazon.kinesis:amazon-kinesis-producer < 1.0.8.
Is there a fix for CVE-2026-119117?
Yes: fixed in Amazon Kinesis Producer Library for Java 1.0.8 or later. Until then: Set the Daemon logger to INFO or higher log level (software.amazon.kinesis.producer.Daemon for 1.x or com.amazonaws.services.kinesis.producer.Daemon for 0.x) to prevent credentials from being written to logs. Additionally, add a log filter that drops or redacts messages beginning "Starting Native Process". Run the producer only on hosts or in containers without untrusted local accounts. Use short-lived IAM role credentials instead of long-lived access keys, scoped to minimal permissions (kinesis:PutRecords and cloudwatch:PutMetricData on specific ARNs). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119117 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-119117?
Check whether you run Amazon AWS or Amazon Kinesis Producer Library for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Amazon Kinesis Producer Library for Java 1.0.8 or later

Set the Daemon logger to INFO or higher log level (software.amazon.kinesis.producer.Daemon for 1.x or com.amazonaws.services.kinesis.producer.Daemon for 0.x) to prevent credentials from being written to logs. Additionally, add a log filter that drops or redacts messages beginning "Starting Native Process". Run the producer only on hosts or in containers without untrusted local accounts. Use short-lived IAM role credentials instead of long-lived access keys, scoped to minimal permissions (kinesis:PutRecords and cloudwatch:PutMetricData on specific ARNs).

Technical details

The vulnerability involves insertion of sensitive information (AWS credentials) into debug logs and process arguments in the Kinesis Producer Library. Local attackers can exploit this by reading unprotected log files when DEBUG logging is enabled, or by examining the process argument list of the native child process spawned by the library. The fix is version 1.0.8 or later; mitigation requires disabling DEBUG logging, filtering log output, and restricting local user access.

Affected products

  • Amazon Kinesis Producer Library for Java com.amazonaws:amazon-kinesis-producer <= 0.15.12; software.amazon.kinesis:amazon-kinesis-producer < 1.0.8

Timeline

  • 2026-10-30: disclosed: AWS security bulletin published
  • 2026-10-30: patched: Version 1.0.8 or later available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.