CVE-2025-7195
BaseFortify
Publication date: 2025-08-07
Last updated on: 2026-03-24
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | multicluster_engine_for_kubernetes | 2.9.1 |
| redhat | openshift_data_foundation | 4.14 |
| redhat | openshift_data_foundation | 4.16 |
| redhat | openshift_data_foundation | 4.18 |
| redhat | advanced_cluster_management_for_kubernetes | 2.14.1 |
| redhat | advanced_cluster_management_for_kubernetes | 2.12.6 |
| redhat | multicluster_engine_for_kubernetes | 2.7.7 |
| redhat | multicluster_engine_for_kubernetes | 2.6 |
| redhat | advanced_cluster_management_for_kubernetes | 2.11.9 |
| redhat | openshift_data_foundation | 4.15 |
| redhat | openshift_file_integrity_operator | 1.3.8 |
| redhat | openshift_data_foundation | 4.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in early versions of Operator-SDK before 0.15.2, where a script called user_setup modifies the permissions of the /etc/passwd file to be group-writable (664) and assigns it group ownership of root during container build time. This insecure permission setting allows an attacker who can execute commands inside the container, even as a non-root user, to modify the /etc/passwd file. By doing so, the attacker can add a new user with any UID, including UID 0 (root), thereby gaining full root privileges within the container.
How can this vulnerability impact me? :
If you use affected Operator-SDK versions and build container images with the insecure user_setup script, an attacker with command execution inside the container could escalate their privileges to root. This could lead to unauthorized full control over the container environment, potentially compromising the security and integrity of your applications running inside the container.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you are not using Operator-SDK versions before 0.15.2. Avoid using the insecure user_setup script that modifies /etc/passwd permissions to 664 with root group ownership during build time. Rebuild your operator container images using Operator-SDK version 0.15.2 or later, which does not include this insecure script. Additionally, verify that the /etc/passwd file inside your container images does not have group-writable permissions or root group ownership to prevent unauthorized modifications.