Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 24 March 2025.

Which products and versions are affected?

aws-cdk-lib (npm) SEMVER:introduced=0,fixed=2.189.0.

Is there a fix for This vulnerability?

Yes. aws-cdk-lib (npm): upgrade to 2.189.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

AWS CDK CodePipeline overly broad IAM trust policy

Severity: low · CVSS 3.1 · Published 2025-03-24

AWS CDK's CodePipeline construct creates IAM roles with trust policies that are too permissive, allowing any authenticated user in the AWS account with sts:AssumeRole permissions to assume those roles. This could enable unauthorized access to pipeline resources including CloudFormation, CodeCommit, Lambda, ECS actions, and artifact storage in S3. The vulnerability requires the attacker to already be authenticated in the account and have unrestricted sts:AssumeRole permissions.

Technologies: aws-cdk-lib (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 24 March 2025.
Which products and versions are affected?: aws-cdk-lib (npm) SEMVER:introduced=0,fixed=2.189.0.
Is there a fix for This vulnerability?: Yes. aws-cdk-lib (npm): upgrade to 2.189.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aws-cdk-lib (npm): upgrade to 2.189.0 or later
```
npm install aws-cdk-lib@2.189.0
```

Technical details

The AWS CDK CodePipeline construct creates multiple IAM roles to orchestrate software release processes. Two of these roles—the stage role and cross-account action role—are created with trust policies that permit the entire AWS account (account root principal) to assume them, rather than restricting assumption to specific pipeline roles or principals. The vulnerability is of class CWE-276 (Incorrect Default Permissions). An authenticated attacker with unrestricted sts:AssumeRole permissions in the target account can assume these overly-permissive roles and leverage any permissions they grant (CloudFormation stack management, CodeCommit access, Lambda invocation, ECS operations, or S3 artifact bucket access). Patches were released in CDK Construct Library v2.189.0, which introduces feature flags @aws-cdk/pipelines:reduceStageRoleTrustScope and @aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope. Existing applications must upgrade and enable these flags, then redeploy. Users who provide their own IAM role for CodePipeline are not affected.

Affected products

AWS aws-cdk-lib <2.189.0

Timeline

2025-03-24: disclosed
2025-03-24: patched: Patch released in CDK Construct Library v2.189.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.