CVE-2025-14503

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/AWS-2025-031/	Patch Vendor Advisory
https://github.com/awslabs/harmonix/pull/189	Issue Tracking
https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:harmonix:*:*:*:*:*:aws:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una política de confianza de IAM excesivamente permisiva en el framework Harmonix on AWS puede permitir que las entidades principales de IAM en la misma cuenta de AWS escalen privilegios mediante la asunción de rol. El código de ejemplo para el rol de aprovisionamiento del entorno EKS está configurado para confiar en la entidad principal raíz de la cuenta, lo que puede permitir a cualquier entidad principal de IAM en la misma cuenta de AWS con permisos sts:AssumeRole asumir el rol con privilegios administrativos. Recomendamos a los clientes actualizar a Harmonix on AWS v0.4.2 o posterior si han desplegado el framework utilizando las versiones v0.3.0 a v0.4.1.

Information

Published : 2025-12-15 20:15

Updated : 2026-10-14 13:10

NVD link : CVE-2025-14503

Mitre link : CVE-2025-14503

CVE.ORG link : CVE-2025-14503

JSON object : View

Products Affected

amazon

harmonix

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2025-14503", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14503", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T04:56:04.348854Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "Harmonix on AWS", "versions": [{"status": "affected", "version": "0.3.0", "lessThan": "0.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-15T20:15:49.190", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-031/", "tags": ["Patch", "Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/awslabs/harmonix/pull/189", "tags": ["Issue Tracking"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges.\n\n\nWe recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1."}, {"lang": "es", "value": "Una pol\u00edtica de confianza de IAM excesivamente permisiva en el framework Harmonix on AWS puede permitir que las entidades principales de IAM en la misma cuenta de AWS escalen privilegios mediante la asunci\u00f3n de rol. El c\u00f3digo de ejemplo para el rol de aprovisionamiento del entorno EKS est\u00e1 configurado para confiar en la entidad principal ra\u00edz de la cuenta, lo que puede permitir a cualquier entidad principal de IAM en la misma cuenta de AWS con permisos sts:AssumeRole asumir el rol con privilegios administrativos.\n\nRecomendamos a los clientes actualizar a Harmonix on AWS v0.4.2 o posterior si han desplegado el framework utilizando las versiones v0.3.0 a v0.4.1."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:harmonix:*:*:*:*:*:aws:*:*", "vulnerable": true, "matchCriteriaId": "DB22DB4B-8396-4C5E-9346-3E20EE111E99", "versionEndExcluding": "0.4.2", "versionStartIncluding": "0.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}