CVE-2025-7195

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

View on CVE.org
Published Aug 7, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.

In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Remediation

Vendor Workaround

In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability. Security Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. Capabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required. allowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities. SELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself. Filesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container's security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-23951 Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Github GHSA Github GHSA GHSA-856v-8qm2-9wjv operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
History
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L'}

 cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.8::el9
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.13::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.17::el9
cpe:/a:redhat:container_native_virtualization:4.20::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.18::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_file_integrity_operator:1 cpe:/a:redhat:openshift_file_integrity_operator:1::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.6::el9
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhosemc:1.0::el8
Vendors & Products Redhat rhosemc
Type Values Removed Values Added
First Time appeared Redhat service Registry
CPEs cpe:/a:redhat:service_registry:2
Vendors & Products Redhat service Registry
Type Values Removed Values Added
First Time appeared Redhat rhosemc
CPEs cpe:/a:redhat:rhosemc:1.0::el8
Vendors & Products Redhat rhosemc
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:devworkspace
Vendors & Products Redhat devworkspace
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.15::el9
cpe:/a:redhat:openshift_data_foundation:4.17::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.14::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.16::el9
References
Type Values Removed Values Added
First Time appeared Redhat openshift Compliance Operator
CPEs cpe:/a:redhat:openshift_compliance_operator:1::el9
Vendors & Products Redhat openshift Compliance Operator
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4 cpe:/a:redhat:openshift_data_foundation:4.18::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.12::el9
cpe:/a:redhat:multicluster_engine:2.7::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.9::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.14::el9
References
Type Values Removed Values Added
First Time appeared Redhat apicurio Registry
Redhat container Native Virtualization
Redhat devworkspace
Redhat jboss Fuse
Redhat webterminal
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:container_native_virtualization:4
cpe:/a:redhat:devworkspace
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:webterminal:1
Vendors & Products Redhat apicurio Registry
Redhat container Native Virtualization
Redhat devworkspace
Redhat jboss Fuse
Redhat webterminal
Type Values Removed Values Added
Description Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file was created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file was created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Title Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
First Time appeared Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift File Integrity Operator
Weaknesses CWE-276
CPEs cpe:/a:redhat:acm:2
cpe:/a:redhat:advanced_cluster_security:4
cpe:/a:redhat:multicluster_engine
cpe:/a:redhat:multicluster_globalhub
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift_data_foundation:4
cpe:/a:redhat:openshift_file_integrity_operator:1
Vendors & Products Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift File Integrity Operator
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L'}
Earlier changes (27)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 21, 2026, 5:17 PM
Reserved
Jul 7, 2025, 8:45 AM

View source JSON

Updated
Aug 7, 2025, 7:23 PM

JSON

Status
Deferred
Published
Aug 7, 2025, 7:15 PM
Modified
Sep 21, 2026, 6:17 PM

View source JSON

Severity
Moderate
Public date
Aug 7, 2025, 6:59 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 4:00 PM

JSON