Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 31 March 2025.

Which products and versions are affected?

aws-cdk-lib (npm) SEMVER:introduced=2.37.0,fixed=2.187.0.

Is there a fix for This vulnerability?

Yes. aws-cdk-lib (npm): upgrade to 2.187.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

AWS CDK cognito.UserPoolClient secret logging to CloudWatch Logs

Severity: low · CVSS 3.1 · Published 2025-03-31

AWS CDK is a framework for defining cloud infrastructure using code. When developers use the Cognito UserPoolClient construct to generate application secrets, those secrets were previously logged in full to CloudWatch Logs. Any authenticated user with read-only access to those logs could view and potentially misuse the secrets to authenticate as the application. Rotating secrets and upgrading CDK resolves the issue.

Technologies: aws-cdk-lib (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 31 March 2025.
Which products and versions are affected?: aws-cdk-lib (npm) SEMVER:introduced=2.37.0,fixed=2.187.0.
Is there a fix for This vulnerability?: Yes. aws-cdk-lib (npm): upgrade to 2.187.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aws-cdk-lib (npm): upgrade to 2.187.0 or later
```
npm install aws-cdk-lib@2.187.0
```

Technical details

The vulnerability is an information disclosure flaw in aws-cdk-lib's Cognito UserPoolClient construct. When the construct performs a DescribeCognitoUserPoolClient API call to retrieve generated client secrets, the full API response—including the plaintext secret—was written to the associated Lambda function's CloudWatch Logs. An attacker requires authentication in the AWS account and read-only permissions on the Lambda log group. The patch, released in version 2.187.0, disables logging of sensitive data by default; existing deployments must explicitly set the feature flag (@aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy, and rotate secrets in AWS Secrets Manager to eliminate exposure.

Affected products

AWS aws-cdk-lib >2.37.0, <2.187.0

Timeline

2025-03-31: disclosed
2025-03-31: patched: Patches included in aws-cdk-lib v2.187.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.