CVE-2025-57853: Privilege Escalation in Red Hat Web Terminal

The core of this vulnerability lies in the group-writable permissions assigned to the /etc/passwd file during the Web Terminal container image build. An attacker who can execute commands within a vulnerable container, even as a non-root user, can leverage their group membership (specifically, membership in the root group) to modify this file. By adding a new user with UID 0 (root), the attacker effectively gains full root privileges within the container's isolated environment. This allows for complete control over the container's resources and potentially access to sensitive data stored within it. The blast radius is limited to the container itself, but the impact within that container is severe.

1. Reserved2025-08-21
2. Published2026-04-08
3. EPSS updated2026-04-16

The primary mitigation for CVE-2025-57853 is to upgrade Red Hat Web Terminal to version 2.5.4 or later, which corrects the file permission issue. If an immediate upgrade is not feasible, consider implementing container security hardening measures. This includes restricting the capabilities of the container, minimizing the user's privileges within the container, and implementing strict access controls. Review container image build processes to ensure proper file permissions are set. While not a direct fix, using a read-only root filesystem within the container can limit the attacker's ability to modify /etc/passwd. After upgrading, verify the fix by attempting to create a new user with UID 0 within a container running the patched version; this should fail.