CVE-2025-8904 describes a high-severity vulnerability in Amazon EMR Secret Agent where Kerberos keytab files, containing sensitive credentials, are insecurely stored in the /tmp/ directory. This allows an authenticated attacker with local access to potentially decrypt keys and escalate privileges within the EMR environment. The vulnerability has a CVSS score of 8.5 (HIGH) due to its network attack vector, high impact on confidentiality, integrity, and availability, despite requiring high attack complexity and low privileges. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on the CISA KEV catalog, indicating no active exploitation. However, there is some community discussion and media coverage, suggesting awareness of the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Amazon | EMR | >= 6.10, < 7.4CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.