This vulnerability arises because certain container images of Red Hat Ansible Automation Platform 2.5 create the /etc/passwd file with group-writable permissions. If an attacker can execute commands inside the container and is part of the root group, they can exploit this permission misconfiguration to modify /etc/passwd. This allows the attacker to add a new user with any UID, including UID 0, effectively escalating privileges to root within the container. The flaw affects version 2 of the product. Red Hat has issued security advisories (RHSA-2026:42141 and RHSA-2026:42144) and released updated container images and patches to remediate this issue.

An attacker with command execution inside an affected container and membership in the root group can escalate privileges to root by modifying the /etc/passwd file. This grants full root privileges within the container, potentially allowing unauthorized actions and control over containerized workloads.

Red Hat has released official security updates for Red Hat Ansible Automation Platform 2.5 that address this vulnerability. Users should apply these updates as described in the Red Hat advisories RHSA-2026:42141 and RHSA-2026:42144. Before applying the update, ensure all previously released errata relevant to your system have been applied. Follow the official Red Hat documentation for upgrading: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading. No additional mitigations are required once the update is applied.