6.4
Moyenne
CVE-2025-8766 A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images
Description
A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Openshift Data Foundation 4 | Versions non publiées | |
| Red Hat Openshift Data Foundation 4.22 1782934284 | premières → < 1782934284 | 1782934284 |
Références
- RHSA-2026:37387 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2387265 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Openshift Data Foundation 4
Les 64 CVE de Red Hat Openshift Data Foundation 4 →
CVE-2026-86330
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api
7.2
Élevée
CVE-2026-94368
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud…
7.1
Élevée
CVE-2026-66792
A flaw was found in the multicloud-operators-subscription component
9.9
Critique
CVE-2026-15416
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an…
8.9
Élevée