Read the docs
TI-2025-02266 Aliases CVE-2025-2598GHSA-v63m-x9r9-8gqp

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

Priority LOW 25CWE-497Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-497.

Summary

When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Fixed Cloud Development Kit Command Line Interface (AWS): 2.178.2aws-cdk (npm): 2.178.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSCloud Development Kit Command Line Interface2.172.0 to before 2.178.22.178.2Patch availableCNA
—aws-cdk (npm)2.172.0 to before 2.178.22.178.2Patch availableGHSA-v63m-x9r9-8gqp
—cdk (npm)2.172.0 to before 2.178.22.178.2Patch availableGHSA-v63m-x9r9-8gqp
  • Cloud Development Kit Command Line Interface VendorAWS Affected 2.172.0 to before 2.178.2 Fixed in 2.178.2 Patch available CNA
  • aws-cdk (npm) Vendor— Affected 2.172.0 to before 2.178.2 Fixed in 2.178.2 Patch available GHSA-v63m-x9r9-8gqp
  • cdk (npm) Vendor— Affected 2.172.0 to before 2.178.2 Fixed in 2.178.2 Patch available GHSA-v63m-x9r9-8gqp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amazon:aws_cloud_development_kit:*:*:*:*:*:*:*:*2.172.0 to before 2.178.2VulnerableAWS
  • cpe:2.3:a:amazon:aws_cloud_development_kit:*:*:*:*:*:*:*:* Versions 2.172.0 to before 2.178.2 Vulnerable ·AWS

Remediation

  • Fix · CNA Cloud Development Kit Command Line Interface (AWS) Fixed in 2.178.2
  • Fix · GHSA-v63m-x9r9-8gqp aws-cdk (npm) Fixed in 2.178.2 Advisory →
  • Fix · GHSA-v63m-x9r9-8gqp cdk (npm) Fixed in 2.178.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2598
  2. 2026-10-03 Alias added: GHSA-v63m-x9r9-8gqp

References

Patch 1

Advisory 3

Other 2

  • TI-2023-17611 AWS CDK EKS overly permissive trust policies CVSS 3.1HIGH 8.8
  • TI-2024-30149 AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template CVSS 3.1MEDIUM 6.4
  • TI-2025-16991 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk CVSS 4.0LOW 1.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences