CVE-2025-57848: A container privilege escalation flaw was found in certain Container-native Virtualization images
Source GCVE Database
Not known to be exploited · CVSS 6.4 Medium : update RHEL-8-CNV-4.12 when convenient.
Data as of 31 Oct 2026, 00:06 UTC
Thin evidence
One scorer or none| CNA (redhat) | CVSS 3.1 | 6.4 |
|---|
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Patches and advisories
- access.redhat.com/errata/RHEA-2025:19904 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:20007 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21119 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21677 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:22750 (opens in a new tab)
- access.redhat.com/errata/RHEA-2026:0511 (opens in a new tab)
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| RHEL-8-CNV-4.12container-native-virtualization/bridge-marker | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cluster-network-addons-operator | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cnv-containernetworking-plugins | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cnv-must-gather-rhel8 | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/hco-bundle-registry | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/hostpath-csi-driver | Affected– | Fixed in– |
AI-suggested
Red Hat has released updated OpenShift Virtualization 4.19.14 images that fix this vulnerability. Users should apply these updates after ensuring all previously released errata are applied. Refer to Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated in the advisory.
Description
A container privilege escalation vulnerability (CVE-2025-57848) exists in certain Container-native Virtualization images due to the /etc/passwd file being created with group-writable permissions during build time. An attacker with command execution inside the container and membership in the root group can modify /etc/passwd to add a user with arbitrary UID, including UID 0, gaining root privileges within the container. The issue has a CVSS score of 5.2 (medium severity). Red Hat has released updated OpenShift Virtualization 4.19.14 images that address this and other issues.
References
- nvd.nist.gov/vuln/detail/CVE-2025-57848 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:19904 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:20007 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21119 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21677 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:22750 (opens in a new tab)
- access.redhat.com/errata/RHEA-2026:0511 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-57848 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2391099 (opens in a new tab)