aws-cdk vulnerabilities

Latest aws-cdk CVEs

Newest publication first

1. CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

   Published 2025-01-17

   Low·CVSS 1.8 EPSS 0.33%

   The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom...

2. CVE-2024-45037 AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template

   Published 2024-08-27

   Medium·CVSS 6.4 EPSS 0.31%

   The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-buil...

3. CVE-2023-35165 AWS CDK EKS overly permissive trust policies

   Published 2023-06-23

   High·CVSS 8.8 EPSS 0.90%

   AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.F...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.