Multicluster Engine For Kubernetes CVE-2025-57851

The CVSS score of 6.4 reflects moderate real-world risk. The attack vector is local (AV:L), requiring the attacker to already have command execution within the container. Attack complexity is high (AC:H), suggesting specific conditions or configurations must be present for successful exploitation. Privilege requirements are high (PR:H), indicating the attacker must already have elevated privileges within the container to exploit the /etc/passwd file permissions. However, the security impact is significant: confidentiality, integrity, and availability are all marked high (C:H/I:H/A:H), confirming that successful exploitation grants full root access with complete system control. No public exploit code availability or CISA KEV status is indicated in the provided intelligence. The risk assessment suggests this is a real but constrained privilege escalation requiring pre-existing container access-not a vector for initial compromise. Organizations running untrusted workloads or multi-tenant container environments face elevated risk.

An attacker gains local execution within a running Multicluster Engine for Kubernetes container as a non-root user (e.g., through a compromised application or supply chain vulnerability). The attacker discovers they are a member of the root group and identifies that /etc/passwd has group-writable permissions. The attacker appends a new user entry to /etc/passwd with UID 0 and elevated group membership, then switches to the newly created root account, achieving full container root privileges and potentially escaping container isolation boundaries to compromise the underlying host or cluster.