CVE-2025-14503 - CVE House

Back to Database

Status published High CVE-2025-14503

Overly Permissive Trust Policy in Harmonix on AWS EKS

8.6 CVSS

Vulnerability Description

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14503

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from AWS

View All →

Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client

Path Traversal in AWS SAM CLI allows file copy to local cache

Path Traversal in AWS SAM CLI allows file copy to build container

Improper timestamp caching during snapshot rollback in tough

Failure to detect delegated target rollback in tough

Affected Vendor

AWS

View all reports →

Affected Software

Harmonix on AWS

Vulnerable Versions:

0.3.0

Timeline

Official Publish: December 15th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1078 Valid Accounts

T1098 Account Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1484 Domain or Tenant Policy Modification

Defense Evasion

T1021 Remote Services

Lateral Movement