Skip to content
Fencer Vulns
medium 6.4

CVE-2025-7195 json

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

published 2025-08-07 15 mo ago modified 2026-09-21 48 d ago also GHSA-856v-8qm2-9wjv , GO-2025-3852 , EUVD-2025-23951

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.

In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Patch / fix

  • go github.com/operator-framework/operator-sdk 0.15.2
  • operator-framework operator-sdk 0.15.2
  • Red Hat RHEL-9-CNV-4.17 v4.17.39-2
  • Red Hat RHEL-9-CNV-4.18 v4.18.25-3
  • Red Hat RHEL-9-CNV-4.20 v4.20.3-3
  • Red Hat multicluster engine for Kubernetes 2.6 v2.6
  • Red Hat multicluster engine for Kubernetes 2.7 v2.7
  • Red Hat multicluster engine for Kubernetes 2.8 1765669648, 1765866268, 1765872398, 1765872399, 1765872400, 1765872402, 1765872406, 1766360304
  • Red Hat multicluster engine for Kubernetes 2.9 v2.9
  • Red Hat OpenShift Compliance Operator 1 1.8.0, 1768172669
  • Red Hat OpenShift File Integrity Operator - FIO 1 v1.3
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 v2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12 1773090513, 1773259164, 1773259182, 1773285089, 1773358651, v2.12
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1767569821, 1767656229, 1767829032
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1769720041, 1769721579, 1770336554, 1770343757, v2.14
  • Red Hat Red Hat Openshift Data Foundation 4.14 v4.14-1764178221, v4.14-1764178222, v4.14-1764178236, v4.14-1764178261, v4.14-1764178273, v4.14-1764178319, v4.14-1764178329, v4.14-1764178354, v4.14-1764178379, v4.14-1764178386, v4.14-1764178406, v4.14-1764178419, v4.14-1764178423, v4.14-1764178615, v4.14-1764178715, v4.14-1764178768, v4.14-1764215448
  • Red Hat Red Hat Openshift Data Foundation 4.15 v4.15-1764176261, v4.15-1764176342, v4.15-1764176372, v4.15-1764176485, v4.15-1764176675, v4.15-1764176690, v4.15-1764176698, v4.15-1764176699, v4.15-1764176892, v4.15-1764176958, v4.15-1764177020, v4.15-1764177029, v4.15-1764177033, v4.15-1764177101, v4.15-1764177174, v4.15-1764221806, v4.15-1764222436
  • Red Hat Red Hat Openshift Data Foundation 4.16 v4.16-1764168955, v4.16-1764169118, v4.16-1764169242, v4.16-1764169347, v4.16-1764169457, v4.16-1764169464, v4.16-1764169479, v4.16-1764169526, v4.16-1764169527, v4.16-1764169544, v4.16-1764169577, v4.16-1764169598, v4.16-1764169623, v4.16-1764169687, v4.16-1764169710, v4.16-1764169730, v4.16-1764170019, v4.16-1764170021
  • Red Hat Red Hat Openshift Data Foundation 4.17 v4.17-1764167795, v4.17-1764167826, v4.17-1764167834, v4.17-1764167876, v4.17-1764167987, v4.17-1764168179, v4.17-1764168431, v4.17-1764168475, v4.17-1764168476, v4.17-1764168536, v4.17-1764168609, v4.17-1764168662, v4.17-1764168699, v4.17-1764168731, v4.17-1764168859, v4.17-1764169063, v4.17-1764169125, v4.17-1764169222
  • Red Hat Red Hat Openshift Data Foundation 4.18 v4.18-1761854280, v4.18-1761854289, v4.18-1761854319, v4.18-1761854321, v4.18-1761854398, v4.18-1761854422, v4.18-1761854430, v4.18-1761854457, v4.18-1761854484, v4.18-1761854489, v4.18-1761854493, v4.18-1761854494, v4.18-1761854504, v4.18-1761854524, v4.18-1761855234, v4.18-1761855467, v4.18-1761855549, v4.18-1762335558
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250814T182633-150000.1.98.1

suse advisories SUSE-SU-2025:02912-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250811T192933-1.1

opensuse advisories openSUSE-SU-2025:15434-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-7195 updated cvss 6.4

operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel8, multicluster-engine/placement-rhel8, multicluster-engine/registration-rhel8, multicluster-engine/addon-manager-rhel8, multicluster-engine/registration-operator-rhel8, multicluster-engine/hypershift-addon-rhel8-operator, +1 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-cluster-permission-rhel8, rhacm2/multicloud-integrations-rhel8, rhacm2/klusterlet-addon-controller-rhel8, rhacm2/multicluster-operators-channel-rhel8, rhacm2/multicluster-operators-application-rhel8 Red Hat build of Apicurio Registry 2 apicurio/apicurio-registry-rhel8-operator
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Fuse 7 fuse7/fuse-apicurito-rhel8-operator fuse7/fuse-apicurito-rhel8-operator
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/cnf-tests-rhel9, openshift4/ztp-site-generate-rhel8, compliance/openshift-compliance-rhel8-operator
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator-rhel9
    affected: workaround, no fix available
  • Red Hat CNV 4.17 for RHEL 9 container-native-virtualization/cluster-network-addons-operator-rhel9 v4.17.39-2
    fixed: vendor fix RHEA-2026:0129
  • Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/cluster-network-addons-operator-rhel9 v4.18.25-3
    fixed: vendor fix RHEA-2025:23478
  • Red Hat CNV 4.20 for RHEL 9 container-native-virtualization/cluster-network-addons-operator-rhel9 v4.20.3-3
    fixed: vendor fix RHEA-2025:23406
show 21 more
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine
    fixed: vendor fix RHSA-2025:23528
  • Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine
    fixed: vendor fix RHSA-2025:19958
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765669648, multicluster-engine 1765866268, multicluster-engine 1765872398, multicluster-engine 1765872399, multicluster-engine 1765872400, multicluster-engine 1765872402, +2 more
    fixed: vendor fix RHSA-2026:0722
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    fixed: vendor fix RHSA-2025:19332
  • Red Hat OpenShift Compliance Operator 1 compliance, compliance 1768172669
    fixed: vendor fix RHSA-2025:21885
  • Red Hat OpenShift File Integrity Operator - FIO 1 compliance
    fixed: vendor fix RHSA-2025:23542
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2
    fixed: vendor fix RHSA-2025:23529
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2, rhacm2 1773090513, rhacm2 1773259164, rhacm2 1773259182, rhacm2 1773285089, rhacm2 1773358651
    fixed: vendor fix RHSA-2025:19961
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1767569821, rhacm2 1767656229, rhacm2 1767829032
    fixed: vendor fix RHSA-2026:0627
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2, rhacm2 1769720041, rhacm2 1769721579, rhacm2 1770336554, rhacm2 1770343757
    fixed: vendor fix RHSA-2025:19335
  • Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764178221, odf4 v4.14-1764178222, odf4 v4.14-1764178236, odf4 v4.14-1764178261, odf4 v4.14-1764178273, odf4 v4.14-1764178319, +11 more
    fixed: vendor fix RHSA-2025:22420
  • Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764176261, odf4 v4.15-1764176342, odf4 v4.15-1764176372, odf4 v4.15-1764176485, odf4 v4.15-1764176675, odf4 v4.15-1764176690, +11 more
    fixed: vendor fix RHSA-2025:22418
  • Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764168955, odf4 v4.16-1764169118, odf4 v4.16-1764169242, odf4 v4.16-1764169347, odf4 v4.16-1764169457, odf4 v4.16-1764169464, +12 more
    fixed: vendor fix RHSA-2025:22416
  • Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764167795, odf4 v4.17-1764167826, odf4 v4.17-1764167834, odf4 v4.17-1764167876, odf4 v4.17-1764167987, odf4 v4.17-1764168179, +12 more
    fixed: vendor fix RHSA-2025:22415
  • Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1761854280, odf4 v4.18-1761854289, odf4 v4.18-1761854319, odf4 v4.18-1761854321, odf4 v4.18-1761854398, odf4 v4.18-1761854422, +12 more
    fixed: vendor fix RHSA-2025:21368
  • Red Hat CNV 4.17 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.17.39-2, container-native-virtualization/pr-helper-rhel9 v4.17.39-2, container-native-virtualization/aaq-server-rhel9 v4.17.39-2, container-native-virtualization/virtio-win-rhel9 v4.17.39-2, container-native-virtualization/wasp-agent-rhel9 v4.17.39-2, container-native-virtualization/kubemacpool-rhel9 v4.17.39-2, +45 more Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.18.25-2, container-native-virtualization/pr-helper-rhel9 v4.18.25-2, container-native-virtualization/aaq-server-rhel9 v4.18.25-2, container-native-virtualization/virtio-win-rhel9 v4.18.25-2, container-native-virtualization/wasp-agent-rhel9 v4.18.25-2, container-native-virtualization/kubemacpool-rhel9 v4.18.25-2, +46 more Red Hat CNV 4.20 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.20.3-6, container-native-virtualization/pr-helper-rhel9 v4.20.3-7, container-native-virtualization/aaq-server-rhel9 v4.20.3-3, container-native-virtualization/virtio-win-rhel9 v4.20.3-4, container-native-virtualization/wasp-agent-rhel9 v4.20.3-3, container-native-virtualization/kubemacpool-rhel9 v4.20.3-3, +48 more Red Hat Multicluster Engine for Kubernetes multicluster-engine/discovery-rhel8, multicluster-engine/clusterlifecycle-state-metrics-rhel8, multicluster-engine/managedcluster-import-controller-rhel8 Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine
    +2 more products
    Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765517627, multicluster-engine 1765517785, multicluster-engine 1765522347, multicluster-engine 1765522349, multicluster-engine 1765755875, multicluster-engine 1765829333, +13 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    not affected: vulnerable code not present
  • Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat OpenShift Compliance Operator 1 compliance, compliance 1768172657, compliance 1768172795, compliance 1768401393, compliance 1768410159 Red Hat OpenShift File Integrity Operator - FIO 1 compliance Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/rbac-query-proxy-rhel9, rhacm2/search-collector-rhel9, rhacm2/metrics-collector-rhel9, rhacm2/iam-policy-controller-rhel9, rhacm2/cert-policy-controller-rhel9, rhacm2/config-policy-controller-rhel9, +5 more Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2, rhacm2 1772926628, rhacm2 1772926643, rhacm2 1773090422, rhacm2 1773099456, rhacm2 1773099472, +33 more
    not affected: vulnerable code not present RHSA-2025:19961
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1767311055, rhacm2 1767311056, rhacm2 1767397077, rhacm2 1767397082, rhacm2 1767397328, rhacm2 1767397377, +36 more
    not affected: vulnerable code not present RHSA-2026:0718
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2, rhacm2 1769990632, rhacm2 1769990643, rhacm2 1770039851, rhacm2 1770049220, rhacm2 1770049695, +34 more
    not affected: vulnerable code not present

10 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

Affected packages

ecosystem package affected fixed in
go github.com/operator-framework/operator-sdk
<0.15.2
0.15.2

Affected products

  • operator-framework operator-sdk
  • Red Hat RHEL-9-CNV-4.17
  • Red Hat RHEL-9-CNV-4.18
  • Red Hat RHEL-9-CNV-4.20
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.7
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat OpenShift Compliance Operator 1
  • Red Hat OpenShift File Integrity Operator - FIO 1
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Openshift Data Foundation 4.14
  • Red Hat Red Hat Openshift Data Foundation 4.15
  • Red Hat Red Hat Openshift Data Foundation 4.16
  • Red Hat Red Hat Openshift Data Foundation 4.17
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Multicluster Global Hub
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Web Terminal

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.