Openshift-ai: privilege escalation via excessive /etc/passwd permissions
Priority LOW 28CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 2.16 | — | sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 2.19 | — | sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 2.21 | — | sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 2.22 | — | sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 2.24 | — | sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8 | Patch available | CNA |
- Red Hat OpenShift AI 2.16 VendorRed Hat Affected — Fixed in sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9 Patch available CNA
- Red Hat OpenShift AI 2.19 VendorRed Hat Affected — Fixed in sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16 Patch available CNA
- Red Hat OpenShift AI 2.21 VendorRed Hat Affected — Fixed in sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b Patch available CNA
- Red Hat OpenShift AI 2.22 VendorRed Hat Affected — Fixed in sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839 Patch available CNA
- Red Hat OpenShift AI 2.24 VendorRed Hat Affected — Fixed in sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8 Patch available CNA
CPE names CNA · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift_ai:2.16::el8 | 2.16 | — | Red Hat |
| cpe:/a:redhat:openshift_ai:2.19::el8 | 2.19 | — | Red Hat |
| cpe:/a:redhat:openshift_ai:2.21::el9 | 2.21 | — | Red Hat |
| cpe:/a:redhat:openshift_ai:2.22::el9 | 2.22 | — | Red Hat |
| cpe:/a:redhat:openshift_ai:2.24::el9 | 2.24 | — | Red Hat |
- cpe:/a:redhat:openshift_ai:2.16::el8 Versions 2.16 — ·Red Hat
- cpe:/a:redhat:openshift_ai:2.19::el8 Versions 2.19 — ·Red Hat
- cpe:/a:redhat:openshift_ai:2.21::el9 Versions 2.21 — ·Red Hat
- cpe:/a:redhat:openshift_ai:2.22::el9 Versions 2.22 — ·Red Hat
- cpe:/a:redhat:openshift_ai:2.24::el9 Versions 2.24 — ·Red Hat
Remediation
Red Hat 5 advisories
- RHSA-2025:17501 Released 2025-10-07 · Red Hat rating ImportantRHOAI 2.24.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.24 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator
- RHSA-2025:16984 Released 2025-09-29 · Red Hat rating ImportantRHOAI 2.19.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.19 registry.redhat.io/rhoai/odh-modelmesh-rhel8, registry.redhat.io/rhoai/odh-rhel8-operator
- RHSA-2025:16982 Released 2025-09-29 · Red Hat rating ImportantRHOAI 2.22.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator
Show 2 more Red Hat advisories
- RHSA-2025:16983 Released 2025-09-29 · Red Hat rating ImportantRHOAI 2.21.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.21 registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator
- RHSA-2025:16981 Released 2025-09-29 · Red Hat rating ImportantRHOAI 2.16.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-modelmesh-rhel8, registry.redhat.io/rhoai/odh-rhel8-operator
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19 and 3 more products — RHSA-2025:16981
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-09818 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminPriority MEDIUM 44
- Advisory ·
Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19 and 3 more products — RHSA-2025:16982
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-09818 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminPriority MEDIUM 44
Show 3 more groups
- Advisory ·
Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19 and 3 more products — RHSA-2025:16983
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-09818 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminPriority MEDIUM 44
- Advisory ·
Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19 and 3 more products — RHSA-2025:16984
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-09818 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminPriority MEDIUM 44
- Advisory ·
Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19 and 3 more products — RHSA-2025:17501
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-09818 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminPriority MEDIUM 44
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:16981 |
| Red Hat OpenShift AI 2.19 | Fixed | RHSA-2025:16984 |
| Red Hat OpenShift AI 2.21 | Fixed | RHSA-2025:16983 |
| Red Hat OpenShift AI 2.22 | Fixed | RHSA-2025:16982 |
| Red Hat OpenShift AI 2.24 | Fixed | RHSA-2025:17501 |
Not affected: 5 products
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.19
- Red Hat OpenShift AI 2.21
- Red Hat OpenShift AI 2.22
- Red Hat OpenShift AI 2.24
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57852
- 2026-10-03 Alias added: GHSA-33j5-frrm-3wg2
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-57852 · CVE Program
- CVE-2025-57852 · NVD
- FIRST EPSS
- GHSA-33j5-frrm-3wg2 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-57852 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences