EUVD-2025-209298
GHSA-49g2-wpmf-55pv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Real-world risk is moderate despite the 6.4 CVSS score. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:U) indicates local attack vector, high complexity, and high privileges required-the attack is not remotely exploitable and requires the attacker to already have container execution access and membership in the root group. However, within containerized environments where multiple users or workloads share container images, this creates a privilege escalation pathway for an already-compromised low-privileged container user. The vulnerability is most critical in multi-tenant container platforms or shared container registries where untrusted workloads run. No evidence of public exploit code or active exploitation (KEV status) was provided, reducing immediate threat urgency. Organizations using Ansible Automation Platform in isolated, single-tenant container deployments face lower risk than those with shared container environments. |
| Exploit ScenarioDerived | An attacker gains non-root shell access to an Ansible Automation Platform 2 container (e.g., through a compromised application vulnerability or misconfigured RBAC in a Kubernetes cluster). The attacker discovers they are a member of the root group (GID 0) and observes that /etc/passwd has group-write permissions. They directly edit /etc/passwd to add a new entry (e.g., pwned:x:0:0::/root:/bin/bash), then switch to that user (su pwned) to gain UID 0 root access, fully compromising the container and potentially the host system if the container is run with privileged capabilities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container images to gain root privileges by modifying the group-writable /etc/passwd file. During the container build process, /etc/passwd is created with overly permissive group-write permissions, enabling any user in the root group to add arbitrary entries including a UID 0 account. This vulnerability requires local container execution access and elevated group membership, but results in complete container compromise when exploited.
RemediationAI
Organizations should apply patched container images from Red Hat's official container registry. Red Hat's security advisory (https://access.redhat.com/security/cve/CVE-2025-57847) provides the specific patched versions and remediation guidance. As an interim workaround, container operators can manually correct /etc/passwd file permissions in existing container images by rebuilding them with corrected Dockerfile directives that explicitly set /etc/passwd to 0644 permissions (e.g., RUN chmod 644 /etc/passwd), and restrict root group membership to only necessary system accounts. All running containers based on affected images should be redeployed with patched versions.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper file permissions (CWE-276: Incorrect Default Permissions) set during container image construction in Red Hat Ansible Automation Platform 2. The /etc/passwd file, a critical authentication and identity database on Unix-like systems, is created with group-writable permissions instead of the secure default of 0644 (owner read-write, group and others read-only). When a non-root user is a member of the root group (GID 0) within the container, they can directly edit /etc/passwd to insert new user entries. By adding an entry with UID 0 and appropriate shell configuration, an attacker gains full root-level access within the container's namespace. This is a container-specific privilege escalation that exploits the container build pipeline rather than kernel or runtime vulnerabilities.
Know when Red Hat Ansible Automation Platform 2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Related Vulnerabilities in Red Hat Container Images Privilege Escalation
View all 5Missing authorization checks in the Red Hat Ansible Automation Platform 2 automation-controller allow an authenticated o
Authenticated users who hold permission to create or modify a project within a single organization can execute arbitrary
Privilege escalation and remote code execution on managed hosts is possible in Red Hat Ansible Automation Platform 2 bec
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
Stored cross-site scripting in the automation-controller component of Red Hat Ansible Automation Platform 2 lets an auth
An authenticated automation-controller administrator in Red Hat Ansible Automation Platform 2 can turn the administrator
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or
Missing object-level authorization in the JobTemplate copy endpoint (CopyAPIView) of AWX and Red Hat Ansible Automation
Exploit-DB