Insecure User Permissions in Operator-SDK from Red Hat

CVE-2025-7195

What is CVE-2025-7195?

Early releases of the Operator-SDK from Red Hat contained a security flaw that allowed the /etc/passwd file to be built with insecure group-writable permissions. This issue arises from the use of the 'user_setup' script, which modifies file permissions during the container image build process. If an attacker gains access to an impacted container, they can exploit their non-root user membership in the root group to alter the /etc/passwd file. This exploitation could allow the attacker to create new user accounts with arbitrary user IDs, including root privileges, posing a severe security risk to the container and its environment.

References