Container Privilege Escalation Vulnerability in Red Hat Process Automation Manager
CVE-2025-58713

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Process Automation 7
Vendor
CVE Published:
8 April 2026

What is CVE-2025-58713?

A security flaw has been identified in specific Red Hat Process Automation Manager container images, stemming from improper permissions set on the /etc/passwd file during the build process. This issue permits an attacker with the ability to execute commands within the vulnerable container, regardless of their user status, to exploit their root group membership. By altering the /etc/passwd file, the attacker can introduce a new user with arbitrary UID, including that of UID 0, which may grant them complete root privileges within the container environment.

References

https://access.redhat.com/security/cve/CVE-2025-58713
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2394419
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue.
.