CVE-2025-57853: falha de média gravidade em Red Hat Web Terminal
Web-terminal: privilege escalation via excessive /etc/passwd permissions
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.2%
A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat Web TerminalCVEs relacionadas — Red Hat Web Terminal
No mesmo produto, das mais perigosas para as menos.
CVE-2026-107174MEDIUMSource-to-image: source-to-image: security boundary bypass via absolute symbolic link extractionEPSS 0.3%CVE-2025-7195MEDIUMOperator-sdk: privilege escalation due to incorrect permissions of /etc/passwdEPSS 0.2%CVE-2026-50240HIGHPipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccountEPSS —