# CVE-2023-35165: AWS CDK EKS overly permissive trust policies

Source: https://junglewise.ai/threats/cve-2023-35165-aws-cdk-eks-overly-permissive-trust-policies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-35165 · Severity: low · CVSS 3.1 · Published 2023-06-19

AWS CDK is a framework for defining cloud infrastructure using code. When using the EKS cluster constructs, the service creates two roles (CreationRole and MastersRole) with trust policies that are overly permissive, allowing any AWS identity in the same account with broad assume-role permissions to impersonate them. An attacker with sufficient IAM permissions could exploit this to gain unauthorized access to Kubernetes cluster management or resource deployment capabilities.

Technologies: [AWS CDK](https://junglewise.ai/threats/technologies/cdk), [aws-cdk-lib (npm)](https://junglewise.ai/threats/technologies/aws-cdk-lib). Vendors: [AWS](https://junglewise.ai/threats/vendors/aws), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-35165 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-35165 being exploited in the wild.

**How severe is CVE-2023-35165?** Low severity, with a CVSS score of 3.1, published 19 June 2023.

**Which products and versions are affected?** AWS CDK aws-cdk-lib >= 2.0.0, < 2.80.0; @aws-cdk/aws-eks >= 1.57.0, < 1.202.0; @aws-cdk/aws-eks >= 1.62.0 (CreationRole); @aws-cdk/aws-eks (npm) SEMVER:introduced=1.57.0,fixed=1.202.0; aws-cdk-lib (npm) SEMVER:introduced=2.0.0,fixed=2.80.0.

**Is there a fix for CVE-2023-35165?** Yes. @aws-cdk/aws-eks (npm): upgrade to 1.202.0 or later; aws-cdk-lib (npm): upgrade to 2.80.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-35165 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-35165?** Check whether you run AWS CDK, @aws-cdk/aws-eks (npm) or aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @aws-cdk/aws-eks (npm): upgrade to 1.202.0 or later

  ```sh
  npm install @aws-cdk/aws-eks@1.202.0
  ```

- aws-cdk-lib (npm): upgrade to 2.80.0 or later

  ```sh
  npm install aws-cdk-lib@2.80.0
  ```


## Technical details

The vulnerability exists in AWS CDK's eks.Cluster and eks.FargateCluster constructs, which create IAM roles with trust policies that include the account root principal, effectively allowing any IAM identity in the account with sts:AssumeRole on "*" to assume these roles. The CreationRole (affected from v1.62.0+) is used by Lambda handlers to create and manage EKS clusters and Kubernetes resources; the default MastersRole (affected from v1.57.0+) grants kubectl command execution permissions. An attacker with a role having broad assume-role permissions could laterally escalate privileges to assume either role and gain cluster management access. The fix, released in v1.202.0 and v2.80.0, restricts trust policies to specific Lambda handler roles instead of the account root principal.

## Affected products

- AWS CDK aws-cdk-lib >= 2.0.0, < 2.80.0; @aws-cdk/aws-eks >= 1.57.0, < 1.202.0; @aws-cdk/aws-eks >= 1.62.0 (CreationRole)

## Identifiers

- CVE-2023-35165
- GHSA-rx28-r23p-2qc3

## Timeline

- 2023-06-19: disclosed: GHSA-rx28-r23p-2qc3 published
- 2023-06-19: patched: Fixed in aws-cdk-lib v2.80.0 and @aws-cdk/aws-eks v1.202.0

## References

- [https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3](https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3)

## Related threats

- [AWS CDK CodeBuild S3 log encryption boolean inversion](https://junglewise.ai/threats/aws-cdk-codebuild-s3-log-encryption-boolean-inversion-53ea58e5)
- [AWS aws-cdk-lib OS command injection in NodejsFunction Docker bundling](https://junglewise.ai/threats/cve-2026-13760-aws-aws-cdk-lib-os-command-injection-in-nodejsfunction-docker)
- [AWS aws-cdk-lib OS command injection in NodejsFunction bundling](https://junglewise.ai/threats/cve-2026-11417-aws-aws-cdk-lib-os-command-injection-in-nodejsfunction-bundling)
- [AWS CDK permissions boundary aspect ordering vulnerability](https://junglewise.ai/threats/aws-cdk-permissions-boundary-aspect-ordering-vulnerability-e2cc5c58)
- [AWS CDK cognito.UserPoolClient secret logging to CloudWatch Logs](https://junglewise.ai/threats/aws-cdk-cognito-userpoolclient-secret-logging-to-cloudwatch-logs-47e1e91f)