AMQ Broker CVE-2025-58712

Exploitation requires the attacker to ALREADY have command execution inside an affected AMQ Broker container as a process whose user is a member of the root group (GID 0) - this is the specific precondition, not generic network access. The concrete enabling defect is that /etc/passwd was created group-writable at image build time, letting a root-group member append an arbitrary UID 0 account. Limiting factors: there is NO network vector (AV:L) and NO initial access provided by this flaw - a separate foothold is required first; it is confined to the container (S:U, no host escape described); and it is irrelevant on images not built with the group-writable /etc/passwd or where workloads cannot execute commands as a root-group member.

This is a locally-exploitable container privilege-escalation flaw (CWE-276, incorrect default permissions) rated CVSS 6.4 Medium with vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and point to LOW-to-MODERATE real-world priority rather than an urgent emergency: the attacker must already have code-execution inside an affected AMQ Broker container, so this is a post-compromise escalation primitive, not an initial-access bug. EPSS is low at 0.21% (10th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis - all three exploitation signals agree that mass exploitation is unlikely. Because it is Red Hat's own product security team (secalert@redhat.com) that reported and fixed it, this reads as a defense-in-depth hardening fix. The one nuance: CVSS marks PR:H, but the described precondition is merely a NON-root user who happens to be in the root group - functionally closer to low-privilege access - so the raw CVSS may slightly understate how easily the final step chains once any foothold exists. Net: patch in normal cycle; it matters most where untrusted or multi-tenant workloads can run commands inside these containers.

An attacker who has already gained command execution inside an affected AMQ Broker container as a non-root user (e.g., via a separate application flaw or a supply-chain foothold) notices their process runs with membership in the root group (GID 0). Because /etc/passwd was built group-writable, they append a new account entry with UID 0, then switch to it to obtain full root privileges within the container. No public exploit code is identified at time of analysis, but the technique is trivial and well-documented.