Vulnerability · Published Aug 13, 2025 · Assigned by AMZN

CVE-2025-8904Privilege escalation issue in Amazon EMR Secret Agent component

High 8.5

In plain English

A high-severity security flaw in EMR from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.

Affected products (as reported)

Vendor	Product	Versions
Amazon	EMR	6.10 – before 7.4

Weakness: CWE-257 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-750-release.html release-notes, patch
https://aws.amazon.com/security/security-bulletins/AWS-2025-017/ vendor-advisory
https://github.com/advisories/GHSA-hf8h-76fm-735v third-party-advisory