Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.5%top 59%

CVE-2025-14503: CWE-266 Incorrect Privilege Assignment in AWS Harmonix on AWS

0
High
VulnerabilityCVE-2025-14503cvecve-2025-14503cwe-266cloud
Published: 06/05/2026 (06/05/2026, 19:19:25 UTC)
Source: CVE Database V5
Vendor/Project: AWS
Product: Harmonix on AWS

Description

Bulletin ID: AWS-2025-031 Scope: AWS Content Type: Informational Publication Date: 2025/12/15 11:45 AM PST Description: Harmonix on AWS is an open source reference architecture and implementation of a Developer Platform that extends the CNCF Backstage project. We identified CVE-2025-14503 where an overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with sts:AssumeRole permissions to assume the role with administrative privileges. Resolution: v0.3.0 through v0.4.1

CVSS v4.0

Score 8.6high

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
None
Vuln. Confidentiality
High
Vuln. Integrity
High
Vuln. Availability
High
Subsq. Confidentiality
None
Subsq. Integrity
None
Subsq. Availability
None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected software

GitHub Actionsmore threats →ai
awslabs/harmonix
pkg:github/awslabs/harmonix
Affected versions
=0.3.0<=0.4.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 06/05/2026, 19:29:57 UTC

Technical Analysis

This vulnerability (CVE-2025-14503) affects AWS Harmonix on AWS framework versions 0.3.0 through 0.4.1. It is caused by an incorrect privilege assignment (CWE-266) in the IAM trust policy, which is overly permissive. Specifically, the trust policy allows IAM principals within the same AWS account to assume a role intended for provisioning EKS environments, effectively enabling privilege escalation. The sample code trusts the AWS account root principal, so any IAM principal with sts:AssumeRole permissions can gain administrative privileges. AWS has released version 0.4.2 or later to fix this issue.

Potential Impact

An attacker with any IAM principal permissions to call sts:AssumeRole within the same AWS account can escalate privileges to administrative level by assuming a role intended for EKS provisioning. This could lead to unauthorized administrative access and control over AWS resources managed by Harmonix on AWS. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Mitigation Recommendations

AWS recommends upgrading to Harmonix on AWS version 0.4.2 or later, which addresses this overly-permissive IAM trust policy vulnerability. Since this is a self-managed framework and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor advisory recommendation to upgrade. No other mitigations are specified.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
AMZN
Date Reserved
2025-12-10T21:04:10.009Z
Cvss Version
4.0
State
PUBLISHED

Threat ID: 694068d4d9bcdf3f3dfeb539

Added to database: 12/15/2025, 20:00:20 UTC

Last enriched: 06/05/2026, 19:29:57 UTC

Last updated: 08/19/2026, 22:52:06 UTC

Views: 336

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses