CVE-2026-119117：Amazon Kinesis Producer Library for Java 日誌與程序引數洩露 AWS 憑證
CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Amazon Kinesis Producer Library for Java 在 1.0.8 之前的版本中，若 logger 設為 DEBUG，可能將 AWS 憑證寫入日誌，並以命令列引數傳遞給子程序，讓本地使用者可讀取。
此漏洞暴露了 AWS 憑證，提醒使用者及時升級與審核憑證，以防止本地使用者竊取敏感資訊。
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Impact
Affected Products
The following products are affected by CVE-2026-119117
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | ff89ba41-3aa1-4d27-914a-91399e9639e5 | ||||
| CVSS 4.0 | HIGH | ff89ba41-3aa1-4d27-914a-91399e9639e5 |
Upgrade Amazon Kinesis Producer Library, rotate credentials, and restrict log data.
- Upgrade to Amazon Kinesis Producer Library version 1.0.8 or later.
- Rotate long-term IAM user keys.
- Revoke active role sessions if necessary.
- Restrict or redact sensitive log data.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-119117 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.