Skip to content
fr Sign in
6.4 Medium

CVE-2025-8766 A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images

Description

A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container

Affected products and versions

Product Affected versions Fixed in
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat Openshift Data Foundation 4.22 1782934284 earliest → < 1782934284 1782934284

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Openshift Data Foundation 4

The 64 CVEs of Red Hat Openshift Data Foundation 4 →
CVE-2026-86330 An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api 7.2 High CVE-2026-94368 A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud… 7.1 High CVE-2026-66792 A flaw was found in the multicloud-operators-subscription component 9.9 Critical CVE-2026-15416 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an… 8.9 High
Track this CVE