CVE-2025-61667

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-61667", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-29T20:25:16.179Z", "datePublished": "2025-11-12T18:50:02.940Z", "dateUpdated": "2025-11-12T21:04:11.852Z"}, "containers": {"cna": {"title": "Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions", "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "lang": "en", "description": "CWE-276: Incorrect Default Permissions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg"}], "affected": [{"vendor": "DataDog", "product": "datadog-agent", "versions": [{"version": ">= 7.65.0 , < 7.71.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-12T18:50:02.940Z"}, "descriptions": [{"lang": "en", "value": "The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades. This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-6852-76c5-6cmg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T20:45:47.511430Z", "id": "CVE-2025-61667", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T21:04:11.852Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T20:45:47.511430Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:45:49.105Z"}}], "cna": {"title": "Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions", "source": {"advisory": "GHSA-6852-76c5-6cmg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "DataDog", "product": "datadog-agent", "versions": [{"status": "affected", "version": ">= 7.65.0 , < 7.71.0"}]}], "references": [{"url": "https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg", "name": "https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades. This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276: Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-12T18:50:02.940Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61667", "state": "PUBLISHED", "dateUpdated": "2025-11-12T21:04:11.852Z", "dateReserved": "2025-09-29T20:25:16.179Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-12T18:50:02.940Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "datadog-agent", "vendor": "DataDog", "versions": [{"status": "affected", "version": ">= 7.65.0 , < 7.71.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades. This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue."}, {"lang": "es", "value": "El Agente de Datadog recopila eventos y m\u00e9tricas de los hosts y los env\u00eda a Datadog. Una vulnerabilidad dentro de las versiones 7.65.0 a 7.70.2 del Agente de Host de Linux de Datadog existe debido a permisos insuficientes establecidos en el directorio 'opt/datadog-agent/python-scripts/__pycache__' durante la instalaci\u00f3n. El c\u00f3digo en este directorio solo es ejecutado por el Agente durante la instalaci\u00f3n/actualizaci\u00f3n del Agente. Esto podr\u00eda permitir a un atacante con acceso local modificar archivos en este directorio, los cuales ser\u00edan ejecutados posteriormente cuando el Agente sea actualizado, resultando en una escalada de privilegios local. Este problema requiere acceso local al host y una cuenta v\u00e1lida de bajos privilegios para ser vulnerable. Tenga en cuenta que esta vulnerabilidad solo afecta al Agente de Host de Linux. Otras variaciones del Agente, incluyendo el contenedor, kubernetes, el host de Windows y otros agentes no se ven afectados. La versi\u00f3n 7.71.0 contiene un parche para el problema."}], "id": "CVE-2025-61667", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61667", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T20:45:47.511430Z", "version": "2.0.3"}}]}, "published": "2025-11-12T19:15:37.193", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/DataDog/datadog-agent: Datadog Linux Host Agent local privilege escalation", "id": "2414630", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414630"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-276", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-61667", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-coredns-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-11-12T18:50:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-61667\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61667\nhttps://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg"], "threat_severity": "Important"}

{"created": "2025-11-13T09:52:20.317645+00:00", "updated": "2025-11-13T09:52:20.317671+00:00", "vendors": ["datadoghq", "datadoghq$PRODUCT$agent", "linux", "linux$PRODUCT$linux"]}