Medium severity · published Mar 21, 2025
CVE-2025-2598
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Aws Cloud Development Kit · Amazon
2.172.0 before 2.178.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2598
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-005/
github.com
https://github.com/aws/aws-cdk/releases/tag/v2.178.2
Vendor Advisory
https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp
More from Aws Cloud Development Kit
8.8
CVE-2023-35165
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation
8.1
CVE-2025-23206
The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation
6.4
CVE-2024-45037
The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code