Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

An attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This allows the attacker to add a new user with UID 0 (root), effectively gaining full root privileges within the container. This can lead to complete compromise of the container and potentially access to sensitive data or systems accessible from the container. The blast radius depends on the container's access and privileges within the broader infrastructure.

1. Reserviert2025-08-21
2. Veröffentlicht2026-04-08
3. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2025-57847 is to upgrade to Red Hat Ansible Automation Platform version 2.5.4 or later. If upgrading is not immediately possible, restrict access to the container and implement strong container security policies. Regularly scan containers for vulnerabilities and enforce the principle of least privilege. Consider using container runtime security tools to detect and prevent unauthorized modifications to the /etc/passwd file. After upgrading, verify the fix by attempting to create a new user with UID 0 within a container and confirming the operation fails.