CVE-2025-57848: A container privilege escalation flaw was found in certain Container-native Virtualization images
Source GCVE Database
Not known to be exploited · CVSS 6.4 Medium : update RHEL-8-CNV-4.12 when convenient.
Data as of 30 Oct 2026, 22:22 UTC
Thin evidence
One scorer or none| CNA (redhat) | CVSS 3.1 | 6.4 |
|---|
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Patches and advisories
- access.redhat.com/errata/RHEA-2025:19904 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:20007 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21119 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21677 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:22750 (opens in a new tab)
- access.redhat.com/errata/RHEA-2026:0511 (opens in a new tab)
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| RHEL-8-CNV-4.12container-native-virtualization/bridge-marker | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cluster-network-addons-operator | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cnv-containernetworking-plugins | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/cnv-must-gather-rhel8 | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/hco-bundle-registry | Affected– | Fixed in– |
| RHEL-8-CNV-4.12container-native-virtualization/hostpath-csi-driver | Affected– | Fixed in– |
Description
A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
References
- nvd.nist.gov/vuln/detail/CVE-2025-57848 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:19904 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:20007 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21119 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:21677 (opens in a new tab)
- access.redhat.com/errata/RHEA-2025:22750 (opens in a new tab)
- access.redhat.com/errata/RHEA-2026:0511 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-57848 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2391099 (opens in a new tab)