PT-2025-51281 · Unknown+1 · Harmonix On Aws+1

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-14503

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Harmonix on AWS versions 0.3.0 through 0.4.1

Description An overly-permissive IAM trust policy within the Harmonix on AWS framework could allow IAM principals within the same AWS account to escalate privileges through role assumption. The EKS environment provisioning role’s sample code is configured to trust the account root principal, potentially enabling any IAM principal in the same AWS account possessing sts:AssumeRole permissions to assume the role and gain administrative privileges.

Recommendations Upgrade to Harmonix on AWS version 0.4.2 or later.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-14503

GHSA-QM86-GQRQ-MQCW

Affected Products

Eks

Harmonix On Aws

References · 8

• https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw · Vendor Advisory
• https://github.com/awslabs/harmonix/pull/189 · Patch
• https://aws.amazon.com/security/security-bulletins/AWS-2025-031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14503 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14503 · Vendor Advisory
• https://twitter.com/greytech_ltd/status/2000844117018841211 · Twitter Post
• https://t.me/cveNotify/146032 · Telegram Post
• https://twitter.com/CVEnew/status/2002857384222540183 · Twitter Post