# CVE-2025-2598: AWS CDK CLI credential exposure in console output

Source: https://junglewise.ai/threats/cve-2025-2598-aws-cdk-cli-credential-exposure-in-console-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-2598 · Severity: low · CVSS 3.1 · Published 2025-03-21

The AWS CDK CLI is a command-line tool that developers use to deploy cloud infrastructure code to AWS. Under certain conditions, when using custom credential plugins that return temporary credentials with an expiration time, the CLI prints sensitive AWS access keys and session tokens to the console output. Any user who can see the console or terminal output gains access to valid AWS credentials.

Vendors: [AWS](https://junglewise.ai/threats/vendors/aws), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-2598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-2598 being exploited in the wild.

**How severe is CVE-2025-2598?** Low severity, with a CVSS score of 3.1, published 21 March 2025.

**Which products and versions are affected?** AWS CDK CLI >=2.172.0, <2.178.2; aws-cdk (npm) SEMVER:introduced=2.172.0,fixed=2.178.2.

**Is there a fix for CVE-2025-2598?** Yes. aws-cdk (npm): upgrade to 2.178.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-2598 attacked?** It is attacked with local access.

**Am I affected by CVE-2025-2598?** Check whether you run AWS CDK CLI or aws-cdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws-cdk (npm): upgrade to 2.178.2 or later

  ```sh
  npm install aws-cdk@2.178.2
  ```


## Technical details

The vulnerability is a credential exposure issue (CWE-497) in the AWS CDK CLI that occurs when custom credential plugins return credentials with an expiration property. The CLI unintentionally prints these credentials to console output instead of handling them securely. The attack vector is local; only users with access to the machine where the CDK CLI was executed can view the exposed credentials. Exploitation requires the developer to use a credential plugin configured to return temporary credentials with an expiration property—plugins without the expiration property are unaffected. An attacker with console access can extract valid AWS credentials and use them to authenticate to AWS. The issue was introduced in version 2.172.0 and patched in version 2.178.2.

## Affected products

- AWS CDK CLI >=2.172.0, <2.178.2
- AWS aws-cdk >=2.172.0, <2.178.2

## Identifiers

- CVE-2025-2598
- GHSA-v63m-x9r9-8gqp

## Timeline

- 2025-03-21: disclosed: Vulnerability published as GHSA-v63m-x9r9-8gqp
- 2025-03-21: patched: Fix released in version 2.178.2

## References

- [https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp](https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp)

## Related threats

- [AWS CDK RestApi incorrect authorization scope in Cognito authorizer](https://junglewise.ai/threats/cve-2024-45037-aws-cdk-restapi-incorrect-authorization-scope-in-cognito)