CVE-2025-57847: Incorrect Default Permissions in Red Hat Red Hat Ansible Automation Platform 2.5
A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.
AI Analysis
Technical Summary
This vulnerability arises because the /etc/passwd file in some Red Hat Ansible Automation Platform 2.5 container images is created with group-writable permissions during the build process. If an attacker can execute commands inside the affected container and is a member of the root group, they can exploit this misconfiguration to modify /etc/passwd. This allows adding a new user with any UID, including 0, effectively escalating privileges to root within the container environment. The vulnerability affects version 2 of the product. The CVSS 3.1 base score is 6.4, indicating a medium severity with local attack vector, high attack complexity, and requiring high privileges but no user interaction.
Potential Impact
An attacker with command execution inside the container and root group membership can escalate privileges to root within the container by modifying /etc/passwd. This grants full control over the container environment, potentially undermining container isolation and security. The vulnerability does not directly affect the host system but compromises container security.
Mitigation Recommendations
Red Hat has released updated container images for Ansible Automation Platform 2.5 that address this issue. Users should apply the updates as per Red Hat's advisory RHSA-2026:42141 and RHSA-2026:42144, ensuring all previously released errata are applied before updating. Detailed upgrade instructions are available in the official Red Hat documentation. Applying these updates mitigates the vulnerability by correcting the file permissions on /etc/passwd in the container images.
CVE-2025-57847: Incorrect Default Permissions in Red Hat Red Hat Ansible Automation Platform 2.5
Description
A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.
CVSS v3.1
Score 6.4medium
Affected software
pkg:rpm/redhat/redhat-ansible-automation-platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises because the /etc/passwd file in some Red Hat Ansible Automation Platform 2.5 container images is created with group-writable permissions during the build process. If an attacker can execute commands inside the affected container and is a member of the root group, they can exploit this misconfiguration to modify /etc/passwd. This allows adding a new user with any UID, including 0, effectively escalating privileges to root within the container environment. The vulnerability affects version 2 of the product. The CVSS 3.1 base score is 6.4, indicating a medium severity with local attack vector, high attack complexity, and requiring high privileges but no user interaction.
Potential Impact
An attacker with command execution inside the container and root group membership can escalate privileges to root within the container by modifying /etc/passwd. This grants full control over the container environment, potentially undermining container isolation and security. The vulnerability does not directly affect the host system but compromises container security.
Mitigation Recommendations
Red Hat has released updated container images for Ansible Automation Platform 2.5 that address this issue. Users should apply the updates as per Red Hat's advisory RHSA-2026:42141 and RHSA-2026:42144, ensuring all previously released errata are applied before updating. Detailed upgrade instructions are available in the official Red Hat documentation. Applying these updates mitigates the vulnerability by correcting the file permissions on /etc/passwd in the container images.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-08-21T14:40:40.821Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-57847","vendor":"Red Hat"}]
Threat ID: 69d664421cc7ad14da7c09ae
Added to database: 04/08/2026, 14:20:50 UTC
Last enriched: 07/21/2026, 17:47:43 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 184
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.