CVE-2025-57847

A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.

Scoring

Severity

MEDIUM

CVSS base score

6.4

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.16%

CWE

CWE-276

Published

2026-04-08

Last modified

2026-09-10

Affected products

• Red Hat Red Hat Ansible Automation Platform 2.5
• Red Hat Red Hat Ansible Automation Platform 2.5
• Red Hat Red Hat Ansible Automation Platform 2.16
• Red Hat Red Hat Ansible Automation Platform 2.18
• Red Hat Red Hat Ansible Automation Platform 2.16
• Red Hat Red Hat Ansible Automation Platform 2.18

Weakness type

• CWE-276

Related vulnerabilities

• CVE-2025-40585 — A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain
• CVE-2020-37129 — Memu Play 7.1.3 - Insecure Folder Permissions
• CVE-2026-21765 — HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
• CVE-2025-62577 — ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged
• CVE-2025-12100 — MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories
• CVE-2025-11575 — MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories
• CVE-2025-11535 — MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
• CVE-2025-10314 — Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows

Markdown version · Browse all CVEs