CVE-2025-14503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14503
An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/AWS-2025-031/ Patch Vendor Advisory
https://github.com/awslabs/harmonix/pull/189 Issue Tracking
https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:harmonix:*:*:*:*:*:aws:*:*
History

30 Jan 2026, 17:02

Type Values Removed Values Added
First Time Amazon harmonix
Amazon
References () https://aws.amazon.com/security/security-bulletins/AWS-2025-031/ - () https://aws.amazon.com/security/security-bulletins/AWS-2025-031/ - Patch, Vendor Advisory
References () https://github.com/awslabs/harmonix/pull/189 - () https://github.com/awslabs/harmonix/pull/189 - Issue Tracking
References () https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw - () https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw - Vendor Advisory
CPE cpe:2.3:a:amazon:harmonix:*:*:*:*:*:aws:*:*

17 Dec 2025, 00:15

Type Values Removed Values Added
Summary (en) An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1. (en) An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

15 Dec 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-15 20:15

Updated : 2026-01-30 17:02

NVD link : CVE-2025-14503

Mitre link : CVE-2025-14503

CVE.ORG link : CVE-2025-14503

JSON object : View

Products Affected

amazon

  • harmonix
CWE
CWE-266

Incorrect Privilege Assignment