CVE-2026-104002

MediumCVSS 5.3/10Last modified Oct 2, 2026

Description

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. 

To remediate this issue, users should upgrade to version 3.35.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-390

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AWSpowertools-lambda-python>= 3.6.0, <= 3.34.0

References

Timeline

Published
Oct 1, 2026
Last modified
Oct 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1040035.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17CVE-2026-1040046.5MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can caCVE-2026-1040056.5A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could cCVE-2026-1040063.7The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up tCVE-2026-1040107.5The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code ExecuCVE-2026-1040128.8The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass AsCVE-2026-1040149.8The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and includiCVE-2026-1040167.5ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast pathCVE-2026-1040188.8An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-CVE-2026-1040199.0OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4CVE-2026-1040207.5Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the applicatCVE-2026-1040217.2The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache