CVE-2025-57847
Container Privilege Escalation in Ansible Automation Platform Images
Publication date: 2026-04-08
Last updated on: 2026-05-01
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | ansible_automation_platform | to 2.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a container privilege escalation flaw found in certain Ansible Automation Platform images. It occurs because the /etc/passwd file is created with group-writable permissions during the build process. An attacker who can run commands inside the affected container, even as a non-root user, can exploit their membership in the root group to modify the /etc/passwd file.
By modifying this file, the attacker can add a new user with any user ID they choose, including UID 0, which is the root user. This effectively allows the attacker to gain full root privileges within the container.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited access inside a container to escalate their privileges to root level. With root privileges, the attacker can perform any action within the container, including modifying system files, installing malicious software, or disrupting services.
Such privilege escalation can lead to a complete compromise of the container environment, potentially affecting the security and integrity of applications running inside it.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the permissions of the /etc/passwd file inside the affected Ansible Automation Platform containers. Specifically, you should verify if the /etc/passwd file has group-writable permissions, which is the root cause of the issue.
- Run the command inside the container to check permissions: ls -l /etc/passwd
- If the output shows group-writable permissions (e.g., -rw-rw-r--), the container is vulnerable.
- Additionally, verify if any non-root user has membership in the root group by running: groups <username>
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the permissions of the /etc/passwd file inside the affected containers to remove group-writable access.
- Change the permissions of /etc/passwd to be non-group-writable by running: chmod 644 /etc/passwd
- Ensure that non-root users do not have membership in the root group within the container.
- Update or rebuild the Ansible Automation Platform container images with corrected file permissions during the build process to prevent recurrence.