According to cloud security firm Wiz, it discovered that a Linux application named Pandoc had a security issue that was being exploited in the field as part of attacks intended to compromise Amazon Web Services’ (AWS) Instance Metadata Service (IMDS).
CVE-2025-51591 (CVSS score: 6.5) is the vulnerability in question. It is a case of Server-Side Request Forgery (SSRF), which enables attackers to compromise a target system by inserting a specially constructed HTML iframe element.
An essential part of the AWS cloud environment, the EC2 IMDS provides details on instances that are currently running as well as temporary, short-lived credentials if the instance is linked to an identity and access management (IAM) role. Any application running on an EC2 instance can access the instance metadata by using the link-local address (169.254.169[.]254).
By allowing programs to authenticate without storing credentials on the computer, these credentials can subsequently be used read more about Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.