# CVE-2025-14503: Overly Permissive Trust Policy in Harmonix on AWS EKS

> CVE-2025-14503: Overly Permissive Trust Policy in Harmonix on AWS EKS. CVSS 7.2 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-14503
Last updated: 2026-10-14T13:10:00Z

- Published: 2025-12-15 19:45 UTC · Updated: 2026-10-14 13:10 UTC · Assigner: AMZN
- CVSS: 7.2 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.52%, 44th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-266

## Description

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

## Affected vendors and products

- AWS: Harmonix on AWS

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-14503)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-14503)
- [https://aws.amazon.com/security/security-bulletins/AWS-2025-031/](https://aws.amazon.com/security/security-bulletins/AWS-2025-031/)
- [https://github.com/awslabs/harmonix/pull/189](https://github.com/awslabs/harmonix/pull/189)
- [https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw](https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-14503 · Markdown: https://rewindex.com/cve/CVE-2025-14503.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-14503 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:22.083Z