Vulnerability Description
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Aws Cloud Development Kit | >= 2.172.0, < 2.178.2 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005/Vendor Advisory
- https://github.com/aws/aws-cdk/releases/tag/v2.178.2
- https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqpVendor Advisory
FAQ
What is CVE-2025-2598?
CVE-2025-2598 is a vulnerability with a CVSS score of 5.5 (MEDIUM). When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credenti...
How severe is CVE-2025-2598?
CVE-2025-2598 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-2598?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Aws Cloud Development Kit.