CVE-2025-2598

low-risk

Published 2025-03-21

When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Aws Cloud Development Kit

Affected Vendors

Amazon

References (3)

Vendor Advisory https://aws.amazon.com/security/security-bulletins/AWS-2025-005/

https://github.com/aws/aws-cdk/releases/tag/v2.178.2

Vendor Advisory https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal