CVE-2025-7195
| Severity | 6.4 Medium CVSS 3.1 |
|---|---|
| Weakness | CWE-276 |
| Published | 7 Aug 2025 |
| Updated | 21 Sep 2026 |
Description
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published a year ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 0.26% chance in 30 days
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Medium or Low severity, no CISA or VulnCheck KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory |
|---|---|
| Finding | This CVE is MEDIUM severity, is not listed in CISA KEV or VulnCheck KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain. |
| Candidate fix | https://bugzilla.redhat.com/show_bug.cgi?id=2376300 : a Red Hat bug: the triage, which links onward to the fix |
References
Timeline
Timeline
| Published | 2025-08-07 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-09-21 | NVD's own last-modified date for this record. |