Skip to main content

CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Bulletin ID: 2026-159-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/30/2026 11:00 PM PDT

Description:

The Kinesis Producer Library (KPL) is an open-source Java library for writing data to Amazon Kinesis Data Streams at high throughput. KPL is a client library that runs inside the customer's application, in the customer's AWS account, using the customer's credentials.

We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.

To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

Impacted versions:

  • com.amazonaws:amazon-kinesis-producer <= 0.15.12
  • oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8

Resolution:

This issue has been addressed in Amazon Kinesis Producer Library for Java (KPL) version 1.0.8. Version 0.x and 1.x users should upgrade to 1.0.8 or later.

Workarounds:

Upgrading to 1.0.8 or later is the only complete fix. Customers who cannot upgrade immediately can reduce risk as follows:

To stop credentials from being written to the log, make sure the Daemon logger is not configured at DEBUG log level or below. Set it explicitly to INFO or higher in the logging configuration, software.amazon.kinesis.producer.Daemon for 1.x and com.amazonaws.services.kinesis.producer.Daemon for 0.x, so that it stays above DEBUG log level even if the root logger is set to DEBUG. KPL's own LogLevel setting does not affect the Daemon logger. As a second layer, add a filter to the log pipeline that drops or redacts messages beginning "Starting Native Process"; secret scanners will likely not detect these values because they are hex-encoded.

No configuration removes the credentials from the native process's argument list in affected versions. To limit who can read it, run the producer on hosts or in containers with no untrusted local accounts.

Rotate long-lived keys, revoke active role sessions where needed, and redact or remove the affected logs. We recommend using short-lived IAM role credentials rather than long-lived access keys, and scoping the role to the minimal permissions the producer needs, such as kinesis:PutRecords and cloudwatch:PutMetricData on the specific stream and namespace Amazon Resource Names (ARNs).

These measures only prevent future disclosure of credentials; credentials already written to logs still need the above remediations.

References:

Acknowledgement:

We would like to thank Justin Capella from Keeper Security for collaborating on this issue through the coordinated disclosure process.


Please email aws-security@amazon.com with any security questions or concerns.