CVE-2025-8904CWE-257

Privilege escalation issue in Amazon EMR Secret Agent component

Critical · published August 13, 2025

CVSS v4.0
9.0
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges.

Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.

The record
Technical detail
CVSS v4.0
9.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-257 · Storing Passwords in a Recoverable Format
Published
2025-08-13T17:06Z
EPSS history
Timeline
  • 13 AUG 17:06Z
    Privilege escalation issue in Amazon EMR Secret Agent component
    cvelistv5