Skip to content
Fencer Vulns
medium 6.1

CVE-2025-5417 json

Rhdh: red hat developer hub user permissions

published 2025-08-19 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-28561

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.

Patch / fix

  • Red Hat Red Hat Developer Hub 1.7.0
  • Red Hat Red Hat Developer Hub 1.7 sha256:aa3c5b50c65aee51b932fafcbf479ce54f15496cffc2744860bd9e135cce815c

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-5417 updated cvss 6.1

rhdh: Red Hat Developer Hub user permissions

  • Red Hat Developer Hub 1.7 rhdh 1.7.0-1754936470
    fixed: vendor fix “Red Hat Developer Hub 1.5 contains mitigation guidelines present at https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html/configuring_red_hat_developer_hub/readonlyrootfilesystem” RHSA-2025:14090
  • Red Hat Developer Hub 1.7 rhdh 1.7.0-1754935808, rhdh 1.7.0-1754942441
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat Developer Hub
  • Red Hat Red Hat Developer Hub 1.7

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.