Amazon Kinesis Producer Library: Credential exposure via logs and process list
Summary
The Kinesis Producer Library for Java (KPL) can write resolved AWS credentials into debug logs when the logger is set to DEBUG. Affected versions also pass these credentials to a native child process as command-line arguments, where other local users can read them from the process list. An attacker with local access and low privileges can obtain AWS credentials, which may allow access to the associated AWS resources. The attack requires local access to the host or container.
Affected
- com.amazonaws:amazon-kinesis-producer (0.x) up to and including 0.15.12
- software.amazon.kinesis:amazon-kinesis-producer (1.x) below 1.0.8
- Note: a third-party listing (VulDB) also names 1.0.0 to 1.0.7; the vendor advisory states below 1.0.8.
Fixed in
- Version 1.0.8 of Amazon Kinesis Producer Library for Java (KPL)
- 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Workaround
- Upgrading to 1.0.8 or later is the only complete fix.
- Set the Daemon logger explicitly to INFO or higher: software.amazon.kinesis.producer.Daemon (1.x) or com.amazonaws.services.kinesis.producer.Daemon (0.x). This keeps it above DEBUG even if the root logger is DEBUG. The KPL LogLevel setting does not affect the Daemon logger.
- Add a log filter that drops or redacts messages beginning with Starting Native Process.
- No configuration removes credentials from the native process argument list; limit local access to the host or container, with no untrusted local accounts.
- These measures only prevent future disclosure; credentials already logged must still be remediated.
Exploitation
- No known exploitation in the wild reported as of 1 Nov 2026.
- No public proof of concept found.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory Java applications that use KPL under both Maven coordinates.
- Identify versions below 1.0.8 and plan the upgrade to 1.0.8 or later.
- Check DEBUG logging settings and set the Daemon logger to INFO or higher as an interim measure.
- Search existing logs for credential strings and redact or delete affected logs.
- Rotate long-term IAM user keys and revoke active role sessions where needed.
- Prefer short-lived IAM role credentials with minimal permissions.
- Restrict local access on hosts and CI/CD runners that run the producer.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-159-AWS aws.amazon.com
- GitHub Release v1.0.8 github.com
- GitHub Security Advisory GHSA-mr97-jq69-qr5f github.com
- GitHub Security Overview amazon-kinesis-producer github.com
- VulDB CVE-2026-119117 (third-party) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:33.
Original description (NVD)
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.