This vulnerability in Red Hat Multicluster Engine for Kubernetes images is due to incorrect default permissions on the /etc/passwd file, which is group-writable. This misconfiguration allows an attacker who can execute commands inside the container and is part of the root group to modify /etc/passwd and create a new user with any UID, including 0 (root). This leads to privilege escalation within the container environment. The CVSS 3.1 vector indicates the attack requires local access with high privileges and high attack complexity, but results in high confidentiality, integrity, and availability impact. The vendor advisory does not currently specify a patch or remediation status.

Successful exploitation allows an attacker with limited container access but root group membership to escalate privileges to full root within the container by modifying /etc/passwd. This compromises container confidentiality, integrity, and availability. There is no indication of impact beyond the container boundary or the host system. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-57851 for current remediation guidance. Until a fix is available, restrict container access to trusted users and avoid granting root group membership inside containers. Monitor vendor communications for updates on patches or official mitigations.