Operator-SDK versions before 0.15.2 include a user_setup script that modifies /etc/passwd permissions to 664 and sets group ownership to root during container image build. This configuration allows any process running inside the container with membership in the root group to modify /etc/passwd. An attacker who can execute commands inside such a container, even without root privileges, may exploit this to add a user with UID 0, effectively gaining root access within the container. This vulnerability affects operator containers scaffolded with Operator-SDK before 0.15.2 if the insecure user_setup script is still used to build images.

An attacker with the ability to execute commands inside an affected container can escalate privileges to root by modifying the /etc/passwd file due to insecure group-writable permissions. This leads to full root privileges within the container, potentially compromising container integrity and security.

An official fix is available in Operator-SDK version 0.15.2 and later. Users and developers should upgrade to version 0.15.2 or newer to eliminate the insecure user_setup script. For existing containers built with earlier versions, rebuild container images using the updated Operator-SDK to ensure correct permissions on /etc/passwd. Follow vendor advisories and update affected components accordingly.