AWS CDK CLI <=2.178.1 Credential Leak via Plugin
CVE-2025-2598 Published on March 21, 2025
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Vulnerability Analysis
CVE-2025-2598 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Exposure of Sensitive System Information to an Unauthorized Control Sphere
The application does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the application does.
Products Associated with CVE-2025-2598
Want to know whenever a new CVE is published for Amazon Aws? stack.watch will email you.
Affected Versions
AWS Cloud Development Kit Command Line Interface:- Version 2.172.0 and below 2.178.2 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2025-2598
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| npm | aws-cdk | >= 2.172.0, < 2.178.2 | 2.178.2 |
| npm | cdk | >= 2.172.0, < 2.178.2 | 2.178.2 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.