Kinesis Producer Library CVE-2026-119117

Two distinct local prerequisites. (1) Process argument-list exposure (CWE-214): affects default configurations of vulnerable KPL versions - the library passes resolved AWS credentials to its native child process as command-line arguments, and any local user on the host can read them from the process argument list; the advisory states no configuration removes this in affected versions. (2) Log exposure (CWE-532): applies only when the Daemon logger (software.amazon.kinesis.producer.Daemon for 1.x, com.amazonaws.services.kinesis.producer.Daemon for 0.x) is set to DEBUG level or below, writing the credentials to the application log in hex-encoded form readable by anyone with log access. Limiting factors: exploitation is strictly local (AV:L) and requires an existing account on the same host (PR:L); it is not remotely exploitable, and the log path is neutralized by keeping the Daemon logger at INFO or higher. The application must also be using credentials worth stealing (notably long-lived IAM user keys).

This is a genuine but access-gated credential-exposure issue, not an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the vendor description agree that exploitation is local: an attacker needs an existing low-privileged account on the same host as the application, so remote mass exploitation is not possible. Against that, the impact is serious - VC:H plus SC:H (subsequent-system confidentiality) reflects that the disclosed artifact is the application's resolved AWS credentials, which can grant access to AWS resources well beyond the compromised host, justifying the 8.2 'High' score. No EPSS probability, CISA KEV entry, or PoC reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by impact and ease-of-read (reading a process argument list or a DEBUG log needs no special skill), not by exploitation likelihood. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a high-impact but locally-scoped flaw. Note one nuance to verify operationally: the two sub-issues differ in exploitability - the native-process argument-list exposure (CWE-214) affects default configurations with no special settings, while the log exposure (CWE-532) applies only when the Daemon logger is at DEBUG level or below.

An application using a vulnerable KPL version runs on a multi-tenant or shared host. A local user with their own unprivileged account inspects the argument list of the KPL native child process (e.g. via /proc) and reads the AWS credentials the library passed to it on the command line; alternatively, if the Daemon logger is at DEBUG level, the same user reads the hex-encoded credentials from the application log. No public exploit is identified at time of analysis, but no tooling beyond standard process/log inspection is required.