CVE-2025-7195 Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

What is CVE-2025-7195?

CVE-2025-7195 is a medium-severity vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 7 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.

In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Weakness: CWE-276

Which versions are affected by CVE-2025-7195?

3 open source packages ship an affected version, including github.com/operator-framework/operator-sdk.

How do I fix CVE-2025-7195?

Upgrade github.com/operator-framework/operator-sdk to 0.15.2 or later.

Is CVE-2025-7195 being exploited?

There is no known exploitation of CVE-2025-7195 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-856v-8qm2-9wjv, GO-2025-3852.