CVE-2026-104002

MediumCVSS 5.3/10Last modified Oct 2, 2026

Description

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask.

To remediate this issue, users should upgrade to version 3.35.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-390

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
AWS	powertools-lambda-python	>= 3.6.0, <= 3.34.0

References

Timeline

Published: Oct 1, 2026
Last modified: Oct 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1040035.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17 CVE-2026-1040046.5MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can ca CVE-2026-1040056.5A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could c CVE-2026-1040063.7The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t CVE-2026-1040107.5The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execu CVE-2026-1040128.8The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass As CVE-2026-1040149.8The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and includi CVE-2026-1040167.5ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path CVE-2026-1040188.8An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-CVE-2026-1040199.0OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4 CVE-2026-1040207.5Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the applicat CVE-2026-1040217.2The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache