Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
Priority LOW 30CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.16 | — | 1789001438 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.16 | — | 1789023765 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.18 | — | 1789023329 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.18 | — | 1789001715 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — | 1784035663 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — | 1789634812 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — | 1784051694 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — | 1789654540 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | 1789658734 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | 1789661423 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | 1789654312 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | 1788901236 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | 1789582543 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | 1789584820 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | — | — | No fix listed | CNA |
- Red Hat Ansible Automation Platform 2.16 VendorRed Hat Affected — Fixed in 1789001438 Patch available CNA
- Red Hat Ansible Automation Platform 2.16 VendorRed Hat Affected — Fixed in 1789023765 Patch available CNA
- Red Hat Ansible Automation Platform 2.18 VendorRed Hat Affected — Fixed in 1789023329 Patch available CNA
- Red Hat Ansible Automation Platform 2.18 VendorRed Hat Affected — Fixed in 1789001715 Patch available CNA
- Red Hat Ansible Automation Platform 2.5 VendorRed Hat Affected — Fixed in 1784035663 Patch available CNA
- Red Hat Ansible Automation Platform 2.5 VendorRed Hat Affected — Fixed in 1789634812 Patch available CNA
- Red Hat Ansible Automation Platform 2.5 VendorRed Hat Affected — Fixed in 1784051694 Patch available CNA
- Red Hat Ansible Automation Platform 2.5 VendorRed Hat Affected — Fixed in 1789654540 Patch available CNA
- Red Hat Ansible Automation Platform 2.6 VendorRed Hat Affected — Fixed in 1789658734 Patch available CNA
- Red Hat Ansible Automation Platform 2.6 VendorRed Hat Affected — Fixed in 1789661423 Patch available CNA
- Red Hat Ansible Automation Platform 2.6 VendorRed Hat Affected — Fixed in 1789654312 Patch available CNA
- Red Hat Ansible Automation Platform 2.7 VendorRed Hat Affected — Fixed in 1788901236 Patch available CNA
- Red Hat Ansible Automation Platform 2.7 VendorRed Hat Affected — Fixed in 1789582543 Patch available CNA
- Red Hat Ansible Automation Platform 2.7 VendorRed Hat Affected — Fixed in 1789584820 Patch available CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform Ansible Core 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Ansible Automation Platform Ansible Core 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
Remediation
Red Hat 11 advisories
- RHSA-2026:71210 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
- RHSA-2026:71192 Released 2026-09-23 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel9
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
Show 8 more Red Hat advisories
- RHSA-2026:71177 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
- RHSA-2026:67279 Released 2026-09-14 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
- RHSA-2026:66487 Released 2026-09-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform Execution Environments Update
- Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
- RHSA-2026:66486 Released 2026-09-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform Execution Environments Update
- Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel9
- RHSA-2026:66485 Released 2026-09-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform Execution Environments Update
- Red Hat Ansible Automation Platform 2.16 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
- RHSA-2026:66482 Released 2026-09-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform Execution Environments Update
- Red Hat Ansible Automation Platform 2.16 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel9
- RHSA-2026:42144 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
- RHSA-2026:42141 Released 2026-07-20 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.16 | Fixed | RHSA-2026:66482, RHSA-2026:66485 |
| Red Hat Ansible Automation Platform 2.18 | Fixed | RHSA-2026:66486, RHSA-2026:66487 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:42141, RHSA-2026:42144, RHSA-2026:71192, RHSA-2026:71210 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:67279, RHSA-2026:71177 |
Not affected: 5 products
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform Ansible Core 2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57847
- 2026-10-03 Alias added: GHSA-49g2-wpmf-55pv
- 2026-10-13 Affected versions changed · CNA
- 2026-10-15 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat
References
More Red Hat Ansible Automation Platform vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
- TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
- TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
- TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
- TI-2023-27712 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 CVSS 3.1HIGH 7.5
Sources
- CVE-2025-57847 · CVE Program
- CVE-2025-57847 · NVD
- FIRST EPSS
- GHSA-49g2-wpmf-55pv · GitHub Advisory Database · CC BY 4.0
- CVE-2025-57847 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences