What’s Vulnerable › Vulnerabilities

CVE-2025-14503: Overly Permissive Trust Policy in Harmonix on AWS EKS

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-15 · updated 2026-10-14
• Weakness: CWE-266

Description

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

Affected products

• AWS Harmonix on AWS: from 0.3.0 before 0.4.2 — fixed in 0.4.2

How to fix

Upgrade to a fixed version: AWS Harmonix on AWS 0.4.2. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-031/
• https://github.com/awslabs/harmonix/pull/189
• https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw

Get alerted when CVE-2025-14503 or the next vulnerability affects your stack