CVE-2025-8766: Incorrect Default Permissions in Red Hat Red Hat Openshift Data Foundation 4.22
A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container
AI Analysis
Technical Summary
This vulnerability involves incorrect default permissions on the /etc/passwd file in specific container images of Red Hat OpenShift Data Foundation 4.22. The file is group-writable, allowing an attacker who can execute commands inside the container and is part of the root group to alter /etc/passwd. This can lead to the creation of a new user with any UID, including 0, effectively escalating privileges to root within the container environment. The CVSS v3.1 base score is 6.4, reflecting a medium severity with local attack vector, high privileges required, and no user interaction needed. The vulnerability is tracked as CWE-276 (Incorrect Default Permissions).
Potential Impact
An attacker with the ability to execute commands inside an affected container and membership in the root group can escalate privileges to root by modifying the /etc/passwd file. This grants full root privileges within the container, potentially allowing unauthorized actions and control over container processes. The impact is limited to container environments where these conditions are met.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state a fix or patch availability for this specific CVE at this time. Users should monitor Red Hat's official security advisories and apply updates or mitigations as they become available. Until a fix is released, restricting access to container command execution and limiting root group membership within containers can reduce risk.
CVE-2025-8766: Incorrect Default Permissions in Red Hat Red Hat Openshift Data Foundation 4.22
Description
A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container
CVSS v3.1
Score 6.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves incorrect default permissions on the /etc/passwd file in specific container images of Red Hat OpenShift Data Foundation 4.22. The file is group-writable, allowing an attacker who can execute commands inside the container and is part of the root group to alter /etc/passwd. This can lead to the creation of a new user with any UID, including 0, effectively escalating privileges to root within the container environment. The CVSS v3.1 base score is 6.4, reflecting a medium severity with local attack vector, high privileges required, and no user interaction needed. The vulnerability is tracked as CWE-276 (Incorrect Default Permissions).
Potential Impact
An attacker with the ability to execute commands inside an affected container and membership in the root group can escalate privileges to root by modifying the /etc/passwd file. This grants full root privileges within the container, potentially allowing unauthorized actions and control over container processes. The impact is limited to container environments where these conditions are met.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state a fix or patch availability for this specific CVE at this time. Users should monitor Red Hat's official security advisories and apply updates or mitigations as they become available. Until a fix is released, restricting access to container command execution and limiting root group membership within containers can reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-08-08T16:07:52.076Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-8766","vendor":"Red Hat"}]
Threat ID: 69b37da62f860ef94357f3fe
Added to database: 03/13/2026, 02:59:50 UTC
Last enriched: 07/17/2026, 08:46:38 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 215
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.