CVE-2025-14503An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption.
Updated under an hour ago ()
Does this affect you?
It affects amazon harmonix. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.
- CVSS
- 7.2 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-266
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
amazon harmonix amazon:harmonix | from 0.3.0 before 0.4.2 | NVD |
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-031/patch, vendor-advisory
- https://github.com/awslabs/harmonix/pull/189issue-tracking
- https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcwvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.