What’s Vulnerable › Vulnerabilities

CVE-2025-8904: Privilege escalation issue in Amazon EMR Secret Agent component

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-13 · updated 2026-06-17
• Weakness: CWE-257

Description

Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.

Affected products

• Amazon EMR: from 6.10 before 7.4 — fixed in 7.4

How to fix

Upgrade to a fixed version: Amazon EMR 7.4. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-017/
• https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-750-release.html
• https://github.com/advisories/GHSA-hf8h-76fm-735v

Get alerted when CVE-2025-8904 or the next vulnerability affects your stack