AWS amazon-kinesis-producer up to 1.0.7 Logging log file

Summaryinfo

A vulnerability labeled as problematic has been found in AWS amazon-kinesis-producer up to 1.0.7. The affected element is an unknown function of the component Logging. Executing a manipulation can lead to log file. This vulnerability is tracked as CVE-2026-119117. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in AWS amazon-kinesis-producer up to 1.0.7. This vulnerability affects an unknown part of the component Logging. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect integrity. CVE summarizes:

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-119117 since 10/29/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 1.0.8 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• AWS

Name

• amazon-kinesis-producer

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion