CVE-2025-14503: CWE-266 Incorrect Privilege Assignment in AWS Harmonix on AWS
Bulletin ID: AWS-2025-031 Scope: AWS Content Type: Informational Publication Date: 2025/12/15 11:45 AM PST Description: Harmonix on AWS is an open source reference architecture and implementation of a Developer Platform that extends the CNCF Backstage project. We identified CVE-2025-14503 where an overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with sts:AssumeRole permissions to assume the role with administrative privileges. Resolution: v0.3.0 through v0.4.1
AI Analysis
Technical Summary
This vulnerability (CVE-2025-14503) affects AWS Harmonix on AWS framework versions 0.3.0 through 0.4.1. It is caused by an incorrect privilege assignment (CWE-266) in the IAM trust policy, which is overly permissive. Specifically, the trust policy allows IAM principals within the same AWS account to assume a role intended for provisioning EKS environments, effectively enabling privilege escalation. The sample code trusts the AWS account root principal, so any IAM principal with sts:AssumeRole permissions can gain administrative privileges. AWS has released version 0.4.2 or later to fix this issue.
Potential Impact
An attacker with any IAM principal permissions to call sts:AssumeRole within the same AWS account can escalate privileges to administrative level by assuming a role intended for EKS provisioning. This could lead to unauthorized administrative access and control over AWS resources managed by Harmonix on AWS. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
AWS recommends upgrading to Harmonix on AWS version 0.4.2 or later, which addresses this overly-permissive IAM trust policy vulnerability. Since this is a self-managed framework and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor advisory recommendation to upgrade. No other mitigations are specified.
CVE-2025-14503: CWE-266 Incorrect Privilege Assignment in AWS Harmonix on AWS
Description
Bulletin ID: AWS-2025-031 Scope: AWS Content Type: Informational Publication Date: 2025/12/15 11:45 AM PST Description: Harmonix on AWS is an open source reference architecture and implementation of a Developer Platform that extends the CNCF Backstage project. We identified CVE-2025-14503 where an overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with sts:AssumeRole permissions to assume the role with administrative privileges. Resolution: v0.3.0 through v0.4.1
CVSS v4.0
Score 8.6high
Affected software
pkg:github/awslabs/harmonixRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-14503) affects AWS Harmonix on AWS framework versions 0.3.0 through 0.4.1. It is caused by an incorrect privilege assignment (CWE-266) in the IAM trust policy, which is overly permissive. Specifically, the trust policy allows IAM principals within the same AWS account to assume a role intended for provisioning EKS environments, effectively enabling privilege escalation. The sample code trusts the AWS account root principal, so any IAM principal with sts:AssumeRole permissions can gain administrative privileges. AWS has released version 0.4.2 or later to fix this issue.
Potential Impact
An attacker with any IAM principal permissions to call sts:AssumeRole within the same AWS account can escalate privileges to administrative level by assuming a role intended for EKS provisioning. This could lead to unauthorized administrative access and control over AWS resources managed by Harmonix on AWS. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
AWS recommends upgrading to Harmonix on AWS version 0.4.2 or later, which addresses this overly-permissive IAM trust policy vulnerability. Since this is a self-managed framework and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor advisory recommendation to upgrade. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2025-12-10T21:04:10.009Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 694068d4d9bcdf3f3dfeb539
Added to database: 12/15/2025, 20:00:20 UTC
Last enriched: 06/05/2026, 19:29:57 UTC
Last updated: 08/19/2026, 22:52:06 UTC
Views: 336
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.