CVE-2025-2598
CVE-2025-2598 · AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
This page contains facts from public vulnerability sources. Check the original advisory before updating.
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS 5.7 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
cloud development kit command line interface
- Versions
- ≥ 2.172.0, < 2.178.2: Affected (semver)
Update to 2.178.2
aws-cdk npm
- Affected ranges
- SEMVER: ≥ 2.172.0, < 2.178.2
Update to 2.178.2
cdk npm
- Affected ranges
- SEMVER: ≥ 2.172.0, < 2.178.2
Update to 2.178.2