CVE-2025-8904

HIGH

Amazon EMR <7.5 - Privilege Escalation

Title source: llm
STIX 2.1

Description

Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.

Scores

CVSS v3 8.5
EPSS 0.0006
EPSS Percentile 17.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-257
Status published
Products (1)
Amazon/EMR 6.10 - 7.4
Published Aug 13, 2025
Tracked Since Feb 18, 2026