Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd (CVE-2025-7195)

Why this deserves its current priority

CVSS is 6.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/compliance/openshift-compliance-rhel8-operator (generic), Red Hat/container-native-virtualization/cluster-network-addons-operator-rhel9 (generic), Red Hat/fuse7/fuse-apicurito-rhel8-operator (generic), Red Hat/multicluster-engine/hypershift-addon-rhel9-operator (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/compliance/openshift-compliance-rhel8-operatorgeneric	*	Not reported
Red Hat/container-native-virtualization/cluster-network-addons-operator-rhel9generic	*	Not reported
Red Hat/fuse7/fuse-apicurito-rhel8-operatorgeneric	*	Not reported
Red Hat/multicluster-engine/hypershift-addon-rhel9-operatorgeneric	*	Not reported
Red Hat/openshift4/cnf-tests-rhel8generic	*	Not reported
Red Hat/openshift4/cnf-tests-rhel9generic	*	Not reported
Red Hat/openshift4/ztp-site-generate-rhel8generic	*	Not reported
operator-framework/operator-sdkgeneric	>=0 <0.15.2	0.15.2

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/compliance/openshift-compliance-rhel8-operator, Red Hat/container-native-virtualization/cluster-network-addons-operator-rhel9, Red Hat/fuse7/fuse-apicurito-rhel8-operator.
Review the reported fix. Source-reported workaround: In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability. Security Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. Capabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required. allowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities. SELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself. Filesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container's security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions.

Evidence timeline and material changes

Published upstream
Aug 7, 2025
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 26, 2026

Sources and claim methodology

Upstream source description

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Quoted source text, attributed separately from HOL analysis.

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwdCVE-2025-7195