Package vulnerability, severity high
Amazon Kinesis Producer Library for Java leaks AWS credentials in debug logs and process arguments (CVE-2026-119117)
Published , updated
Amazon Kinesis Producer Library for Java before 1.0.8 can write the AWS credentials it resolved to logs when the Daemon logger is at DEBUG level. Affected versions also pass these credentials to the native child process as command-line arguments, where local users can read them. AWS fixed the issue in version 1.0.8.
What's affected
- com.amazonaws:amazon-kinesis-producer (maven)<=0.15.12
- software.amazon.kinesis:amazon-kinesis-producer (maven)<1.0.8
What to do
- Upgrade to Amazon Kinesis Producer Library 1.0.8 or later; users of 0.x should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.
- Rotate any long-term IAM user keys and revoke active role sessions where needed.
- Redact or remove logs written by affected versions, and keep the Daemon logger at INFO or higher until upgraded.
- Run the producer on hosts or containers with no untrusted local accounts, and prefer short-lived IAM role credentials with minimal permissions.
Secrets to rotate if you were affected
Cloud credentials.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident amazon-kinesis-producer-credential-exposure-2026-10References
Notice amazon-kinesis-producer-credential-exposure-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.