CVE-2025-57847 Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: unaffected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Antony Di Scala and Mike Whale for reporting this issue.
Published: 2026-04-08T13:55:00.729Z