CVE-2025-14503: Overly Permissive Trust Policy in Harmonix on AWS EKS
An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges.
We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Harmonix on AWSto a version that resolves this vulnerability.Fixed in 0.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14503?
CVE-2025-14503 is rated as critical due to the potential for privilege escalation through an overly-permissive IAM trust policy.
How do I fix CVE-2025-14503?
To fix CVE-2025-14503, you should review and modify the IAM trust policy to restrict permissions and prevent unauthorized role assumption.
Who is affected by CVE-2025-14503?
CVE-2025-14503 affects users of the Harmonix on AWS framework, specifically those using versions between 0.3.0 and 0.4.1.
What is the cause of CVE-2025-14503?
CVE-2025-14503 is caused by an overly-permissive IAM trust policy that trusts the account root principal, allowing authenticated users to escalate privileges.
Can CVE-2025-14503 be exploited remotely?
CVE-2025-14503 requires authentication, but once authenticated, an attacker could exploit the vulnerability to escalate privileges.