CVE-2025-14503

Overly Permissive Trust Policy in Harmonix on AWS EKS

State: Published
Severity: 8.6 High
Published: Dec 15, 2025
Updated: Feb 26, 2026
Reserved: Dec 10, 2025

Description

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges.

We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
Harmonix on AWSAWS	0.3.0 to before 0.4.2Affected

References

https://github.com/awslabs/harmonix/pull/189patch
https://aws.amazon.com/security/security-bulletins/AWS-2025-031/vendor-advisory
https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcwthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.