AWS CDK Asset Bundling Vulnerability Allows Symlink Injection via Docker Files
A flaw in AWS CDK allows untrusted Docker files to insert symlinked files during asset bundling, affecting versions before 2.267.0.
Key points
- CVE-2026-107608 affects aws-cdk-lib versions prior to 2.267.0.
- The vulnerability allows Docker files to insert symlinked files into bundling output.
- AWS published the advisory on October 8, 2026, rating it as important.
Amazon Web Services has published a security bulletin addressing a vulnerability in its Cloud Development Kit (CDK) that allows for improper link resolution during asset bundling. The issue, identified as CVE-2026-107608, was disclosed on October 8, 2026, and affects all versions of the aws-cdk-lib module prior to 2.267.0.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-107608
According to the AWS Security Bulletins, the flaw occurs when AWS CDK invokes the asset bundling process using a Docker file. In impacted versions, a Docker file can be configured to insert symlinked files or directories into the bundling output. Crucially, these symlinks are not provided as input to the bundling process but are generated within it. This behavior bypasses expected input validation, potentially allowing unauthorized file structures to be included in the final infrastructure assets.
Context and Background
AWS CDK is an open-source framework that enables customers to define cloud infrastructure using standard programming languages, including Python, TypeScript, C#, and Go. Developers use the framework to write code that is subsequently deployed to AWS CloudFormation via command-line tools. The asset bundling feature is a core component of this workflow, responsible for packaging code and dependencies required for deployment.
The vulnerability stems from how the bundling process handles file system operations when interacting with Docker environments. By manipulating the Docker file configuration, an actor could influence the output directory structure without those elements being explicitly declared in the source code provided to the bundler. This discrepancy between input and output can lead to unexpected file inclusions, which may compromise the integrity of the infrastructure definition or expose sensitive data if the symlinks point to restricted resources on the build host.
Who is Affected
The advisory states that all versions of aws-cdk-lib before 2.267.0 are impacted. Organizations and developers using AWS CDK to manage infrastructure-as-code workflows are at risk if they utilize the asset bundling feature with Docker files. The vulnerability is particularly relevant for teams that automate deployment pipelines or use third-party Docker images in their build processes, as trust assumptions around the bundling output may be violated.
AWS has classified the bulletin as "Important," indicating that it requires attention. The vendor has released version 2.267.0, which addresses the improper link resolution issue. Users are advised to review their current aws-cdk-lib versions and upgrade to the patched release to mitigate the risk of symlink injection.
What should you do?
Security teams should immediately audit their infrastructure code repositories for usage of aws-cdk-lib. Identify any projects relying on versions prior to 2.267.0 and prioritize upgrading to the latest stable release. Developers should also review their Docker files used in CDK bundling processes to ensure they do not contain unexpected link configurations or untrusted inputs that could exploit this behavior before upgrading.
What to do and how to stay safe: AWS
- Inventory all projects using aws-cdk-lib and check their current version numbers against the impacted range.
- Upgrade aws-cdk-lib to version 2.267.0 or later once the vendor provides the update.
- Review Docker files used in CI/CD pipelines for any commands that create or manipulate symlinks.
- Monitor AWS Security Bulletins for further guidance or additional related vulnerabilities.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107608?
It is a vulnerability in AWS CDK where Docker files can insert symlinked files into the asset bundling output without those symlinks being provided as input.
Which versions of AWS CDK are affected?
All aws-cdk-lib versions before 2.267.0 are impacted by this vulnerability.
When was this vulnerability disclosed?
AWS published the security bulletin on October 8, 2026.
