Skip to content
OpenAdvisories
Medium · 5.5 Public exploit CVE-2025-2598 EUVD-2025-7239GHSA-v63m-x9r9-8gqp

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

Published Mar 21, 2025 · Updated Oct 14, 2025 · Assigned by AMZN

Vendor: AWS Product: Cloud Development Kit Command Line Interface Package: aws-cdk Package: cdk Ecosystem: npm

Description

When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

VendorProductAffectedFixed
AWS Cloud Development Kit Command Line Interface 2.172.0 – < 2.178.2 2.178.2

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm aws-cdk >= 2.172.0, < 2.178.2 2.178.2 GHSA-v63m-x9r9-8gqp
npm cdk >= 2.172.0, < 2.178.2 2.178.2 GHSA-v63m-x9r9-8gqp

References