{"cve":"CVE-2023-35165","nvd":{"published":"2023-06-23T21:15:09.553","modified":"2026-06-17T06:04:32.070","status":"Modified","description":"AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. \n \nThe first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected.\n \nThe second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected.\n\nThe issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. There is no workaround available for CreationRole. To avoid creating the `default MastersRole`, use the `mastersRole` property to explicitly provide a role.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-863"],"references":["https://github.com/aws/aws-cdk/issues/25674","https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3","https://github.com/aws/aws-cdk/issues/25674","https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3"],"products":["amazon:aws_cloud_development_kit"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-35165","score":0.00897,"percentile":0.59589,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-rx28-r23p-2qc3","url":"https://osv.dev/vulnerability/GHSA-rx28-r23p-2qc3","summary":"AWS CDK EKS overly permissive trust policies","modified":"2026-09-10T03:49:42.502343293Z","packages":[{"ecosystem":"npm","name":"aws-cdk-lib","purl":"pkg:npm/aws-cdk-lib","ranges":[">=2.0.0 <2.80.0"],"fixed":["2.80.0"]},{"ecosystem":"npm","name":"@aws-cdk/aws-eks","purl":"pkg:npm/%40aws-cdk/aws-eks","ranges":[">=1.57.0 <1.202.0"],"fixed":["1.202.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}