PT-2025-33036 · Amazon · Amazon Emr

Published 2025-08-13 · Updated 2026-01-12 · CVE-2025-8904

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Amazon EMR versions 6.10 through 7.4 Amazon EMR version 7.5 and higher

Description: Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges.

Recommendations: Upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, run the bootstrap script and RPM files with the fix provided by the vendor.

Fix

LPE

Weakness Enumeration

CWE-257

Related Identifiers

CVE-2025-8904

Affected Products

Amazon Emr

References · 14

• https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-750-release.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-8904 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2025-017 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1955685713577492490 · Twitter Post
• https://twitter.com/CVEnew/status/1955683530635112829 · Twitter Post
• https://twitter.com/TechBlitzHQ/status/2010546259510137020 · Twitter Post
• https://twitter.com/eyalestrin/status/1956054774375440540 · Twitter Post
• https://t.me/cveNotify/135920 · Telegram Post
• https://github.com/advisories/GHSA-hf8h-76fm-735v · Note
• https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-release-app-versions-7.x.html · Note
• https://twitter.com/0dayPublishing/status/1978161186135740515 · Twitter Post
• https://t.me/cveNotify/138625 · Telegram Post
• https://twitter.com/alex_pulver/status/1964931392216682904 · Twitter Post
• https://t.me/CVEtracker/29915 · Telegram Post