CVE-2026-107783: Insertion of sensitive information into log file in AWS Tools for PowerShell
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.
To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Tools for PowerShellto a version that resolves this vulnerability.Fixed in 5.0.306 - Operational
After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords, then rotate any affected IAM console passwords.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who can access command output, PowerShell transcripts, or log artifacts containing the affected output may be able to recover an IAM user's cleartext AWS Management Console password. Exploitation also requires a user to perform the relevant action that produces the password in output.
Which versions are affected, and what is the fix?
AWS Tools for PowerShell versions before 5.0.306 are affected. Upgrade to version 5.0.306 or later.
What should be done if sensitive output may already have been logged?
Review PowerShell transcripts and log stores for previously disclosed passwords. Rotate any IAM console passwords found to have been exposed.