CVE-2025-8766 Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container
An attacker with container access can modify /etc/passwd to gain root privileges due to excessive file permissions in the noobaa-core image.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8766?
CVE-2025-8766 is a medium-severity vulnerability in Red Hat Openshift Data Foundation 4.22, published on 13 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container
Weakness: CWE-276
Which versions are affected by CVE-2025-8766?
It affects 1 product.
Products include Redhat Openshift Data Foundation.
How do I fix CVE-2025-8766?
No fix has been published for CVE-2025-8766 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8766 being exploited?
There is no known exploitation of CVE-2025-8766 in the wild and no public exploit code.
Sources
Also known as GHSA-fmgm-mwqg-8w89.