Operator SDK <0.15.2 RCE via insecure user_setup /etc/passwd
CVE-2025-7195 Published on August 7, 2025

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-7195 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.

Attack Vector:

LOCAL

Attack Complexity:

HIGH

Privileges Required:

HIGH

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

HIGH

Availability Impact:

LOW

Weakness Type

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Products Associated with CVE-2025-7195

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-7195 are published in these products:

Openshiftfileintegrityoperator 1

Acm 2

Advancedclustersecurity 4

Apicurioregistry 3

Jbossfuse 7

Openshift 4

Openshiftdatafoundation 4

Containernativevirtualization 4

Webterminal 1

Red Hat Openshift File Integrity Operator

Red Hat Multicluster Engine

Red Hat Multicluster Globalhub

Red Hat Acm

Red Hat Advanced Cluster Security

Red Hat Apicurio Registry

Red Hat Jboss Fuse

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Devworkspace

Red Hat Container Native Virtualization

Red Hat Webterminal

Red Hat Openshift Compliance Operator

Affected Versions

Red Hat Compliance Operator 1:

Version sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:1c49bf643ea000a0f92a1d93114a4a866ff51f47947c6a7102fb8e200ae57e8a and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:4364624686c53f5996960296f8ce496ee819d500eab396f35f7bf417dfdf08b9 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:b8e9e8ba56e74a8ca955d5e552ee7177c7468f7d32f0b0cecd5ec712641db09e and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:d6daba3c061a1405e127105d9cd8d719bf793c3c375bdbdd839f0d0ae5517fe9 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:c5e7e0f82b73bcdfc594b25ecb2273819fd28dfbbecb4045f997da3d18a398dd and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:1a2ef170407505193e8d1ab4832ae0b945ec2fd9245c5a93134ce73f959ea34c and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:53532c4f8a3328788f7ad9ce1de7e94fe3c590dcdf367e04a4e47c190a0d39c7 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:17ff83445d5f6c2296f1b5c5061734a7866c84f6951e140f194bb5a1b2c981a2 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:1c49bf643ea000a0f92a1d93114a4a866ff51f47947c6a7102fb8e200ae57e8a and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:4364624686c53f5996960296f8ce496ee819d500eab396f35f7bf417dfdf08b9 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:b8e9e8ba56e74a8ca955d5e552ee7177c7468f7d32f0b0cecd5ec712641db09e and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:c82fe71551720c0af6d8d209842aaea41eb6fba1a5651ea13dc4c6fcfddc66a3 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:c5e7e0f82b73bcdfc594b25ecb2273819fd28dfbbecb4045f997da3d18a398dd and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:1a2ef170407505193e8d1ab4832ae0b945ec2fd9245c5a93134ce73f959ea34c and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:53532c4f8a3328788f7ad9ce1de7e94fe3c590dcdf367e04a4e47c190a0d39c7 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version sha256:17ff83445d5f6c2296f1b5c5061734a7866c84f6951e140f194bb5a1b2c981a2 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:92dcf853dee08f8f68d43d6928df81e0e03cb95ed1c7b9035de089ec831ac12f and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:c124e98be5de4a56ea655e4beca79f2858b32465fd20e07773e7a1395ab698bf and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:3d3c96fd84e118f8236161bf16f22e2456a84fb38b0cd80406e97ada5149d30f and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:c09f09d492589e985ade4c480b5bcefa5ee8d5fd819c6a4953d581f60b609738 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:2e11b27b9d6884dcb846865d632c141a038f85163b0c4db63a1f29cb8d277125 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:5ad05f728a9409bccca7af882d0bb7161a2269d8336ad3e63c3236c9023e017a and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:e9a01f91576307ab1e618ce7e4db1c116b2eb9701c5f5a48b0ad671fa57dc18d and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.9:

Version sha256:ae7818eab65947f74badec716268053224a27b53d704d89c455380d54009c10c and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.12:

Version sha256:e1ed0e73c99eb402fe547d9c112e3c2b9d23ff1fc5dda797638eebb42f4791be and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.12:

Version sha256:e1ed0e73c99eb402fe547d9c112e3c2b9d23ff1fc5dda797638eebb42f4791be and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version sha256:1b56fc6c4b897bb8a62b1fa176af6bace8282b2de38e3e69b5673c5ae3e6848c and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:b4568ee6f890f98c1ac67b7115931a0f16bb1d69f3863ce554efddf64ce7b765 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:13b0299a3e045cc02e6d864398e3676b1dc038504fab8993a92b8b8fdff252c6 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:152c336c76cc69fc11cd6d3957c781c8d1c733a3cbead2448efd202b35d034e2 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:ab2921016d982438eec637035fe678a842757b9822bf6f80936137825dacf45b and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:e529edb5b01923fc4c44fc8b999ca05719365c2e9ea13e579ecd29e4b4c7e02b and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:4c3a738aa7e83a7aea9161c4ef48624a275756531a3d67b13e59b600a4e644ea and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:d3850e64b6707d4fa8c87efd652e4b06ee122c58fe43040b371295626f7d3784 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:ab7a97cfde454612e61f37486bdddca9e9c449c6ea75da71f2399d35de63ae3a and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:10de7f45e7adf11c48fd3311bfdf50c80af2c15b36d54d2565e9115dbe74747b and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:d48c4170807496eea6ebd3c101b3ebfdc6230fec6ede62c04235fb0acdc06a53 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:9797b04acafa870f77bdc28f848347a2a54c29a4d4bea10141f3240d03bc02c8 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:0e87484dee4724fc0bfc1a2edd4f60dd558aaa2a38c783c0f80b3c4a4a3ce8d6 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:d10840f73008b75bd8550baa67ce453e27ae44bfdb4515fe53752078d460edfb and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:823fc904b55808456d855bd842a77db55a66ef0f56c8fdc00cd7812c0c865fcc and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:babfb7fa894d83f591bd3bb17621a440bd9e6e001e4530a01de65bb36fc025b5 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:9592e63b97947aa2f4a695c7c727bef327595d84350640a3dac51de86ef08e07 and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:2dd678e13edff8659bc429b59d9a4a8129c4dca61da8a2e623eabfadc99c35bd and below * is unaffected.

Red Hat Openshift Data Foundation 4.14:

Version sha256:1587bf92b7369eaefbf2828c324ceb585b3591c397fd1ecd59804875ab7cf64f and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:78175febe7b181ade5054857d20b097797663c72cb17cbae4203958e8a351329 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:308cd8acade8e07b3183bbe8735b724b866a7337491afc78967eecd2c812d5e3 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:342ec40b4be75a43a6dc9bd86bdd684ffad05c04e177a173273f1d892e2501dd and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:2012c48688b519ce45f08e1392fd886400a1782ea4bf942e434b4281cebca64e and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:08df676115e46d1dea0c175df6e56f4501aa79d9590ed9790e1d218994999839 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:d79168a44c5789d77d249f5ec981d36345cfbd834ee6cef2de0eb8d90e8bf308 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:4b1ccf7e715bc66b0e205e6db3ba587594c003fefc3de3508cb49f0e5daefeef and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:43232acc4c36c387bfcf4eff514d2bbac42c6baf4aa1a9921abd04f8a05ab6bd and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:a9e4048acb30be2f27d19cf0657d8689dd6dad4cb6b6d80f8fc56b9b2ac3b595 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:ead76cf0baeff4665c19b47e451f4f73c7ec4a286fe5b0eddf6f2256af5195cc and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:38cb8bd22d70d3bce535843ff70bc7b80dcea847ed1debab7e9f3ffe34eb6e81 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:d119048323da12d5d3ee506a4cd2e428bfd302ec4e219fbc961072bc6efe3f7a and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:3b5d7efdc37addbcfe93f01d80e7c8cf35a0167d6cee67532604c5a08326f978 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:6e62b04f43e61a08cebddd4155ad7240a876ce96c4f2f950556559bfc99e8c78 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:12451b0a143da79ef8012629abdf852c94a2388e0fc35cf0d550493a430b5d67 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:55604e05935f27a493571fde6dc84efe20f1480b00bf2918389d0c3df8dbea9c and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:e0fbc579cd5b24ed0f0dba79b145ed8931465e4f428eec49cd46f1269d8fc8f2 and below * is unaffected.

Red Hat Openshift Data Foundation 4.15:

Version sha256:f4a5e16ed21a930a510b5f695a645be2cb6bff1487f5865650fe3c0759e25689 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:28f2860ac1920009eda82fadd3bd134aa53e410974f257b2d700dd57a5ce55c8 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:f1c8c40ee99ee53c66bba5a4d81c87f1396097316f31dec48a1646701f41f232 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:8c9693993390434902aef2af7beb58823b8646dad7f3ac317ec7e7faafde9767 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:e6fb7a9352e05748be5085eb685af6ecd4ac6c466fac27f6391b1e801f79c7c8 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:d76fb81a135d7d65adc9f7c73c891148662810dfb013446bbcd17215dc48ab66 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:be114324106bac45e644e8a4c13dad7699e8808fcaf7da535fe9e7cdc06f1796 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:e4bf6d76d50ba119227780b6dd86947c760d6195da3bed49b0f6f99a43ea0501 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:b4b85e7dcb3fd751c6a8efe6fe43bf5b588850c1e8586f41fffe4f396c2dba54 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:e471d0bc4bc0ed4c3a78b863fde8925079b19d7a8b876144057e740801a24c39 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:0569ea1b4783e21b056242d9f2a40a548ff560a5ab957245444cc3770ed664db and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:a5dd9395692c23d4809d2bd4a4e3210b48498a0a9754cdd53fd2e536b96a0178 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:befb8628ba9619d150958d10500a775dee304a87e7bd2dca62f43a9eb19f44ab and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:cd9a58d3ac10d7ac072ad056ff897565308e798cd0bb8ce50248924fa6f904c5 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:c9324a2d5b26b70917535cff2401d8d94c2d5921164e2ea9af4880c9d423426e and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:b1c07e33fd56322a7b6e26086cbe1bd1bc76651cc2b85984e12818a96b6b3ed1 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:b0b7b38bcb61288eaf3a7f7339ed0b2f4dbbf463f71ee6f64400dbecbf995d31 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:370919c761070db74ae3d81496c801f0946a93b363f9457d2c77d57c51a8fc04 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version sha256:875e86d19b02583156eb12fc726b5089a377403088389997383c0c986e3b2fc1 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:fa22abd3771012d249add9357a05ac7adb6d41783f09fb0920cbc340a3134739 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:c7705b99cc2d009d2e0f09fd5051f8b971af863384c2b71e4923f52f3430febf and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:c934f1d948599bb2ab0f3dbf567b965dac1f2253c51b922cb6df5584592f0685 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:c0a8b08176be1737fb15f9e68444b7fe56678071518253ed3ad82c9f9c0bb8d5 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:166573d2a6d90fe041bccb6ccb867e487131fce54ddf6e52bfaf79859bcd9cb7 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:4b3115829f2443bc90d15421da6e0679d7f9364639a46bd43aa858ec5e2109f7 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:eed37ac242b6eac361d12ac61bd1d9be070ec6243dc2724c778284aa21db815c and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:f7d2d378424b19d0192cf0a9b09a7d17bf0a10a5cb4a74ac60884919b6e2b160 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:8903e0bced0e11a54fcba807bda0e5e4a4ca3072c62b3e1a8262df657e5de955 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:0c3219a8065376f68178b94273c691afa37d5b2ab49f26e1f8167624a1487965 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:2a6aec8c3e6722776c2e16b6029d3fc104dbe64a434b05a4daade197cf6ce030 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:61ecd4e7a8b3074bb25090e0453f523677ac9db486b26acd5624e47dfeea977c and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:198b75c63870db6f31e6e9e9b2d6c90ab2a8739ffd5d2d4db24a22ebdadc3fc7 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:9ede20bd542e2b8e5e695d72acf568bd0f2f6368833b91b43935f9fd1c9016f8 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:6812730c7d8139d2c212088c4f0ad0740f39cc5a56a449a008aef2fb58c15f0e and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:00b3718224bcd0b08300680b8cf5b5525cb959db13d607ee93c2f836b759501e and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:b5c2f9936dee5d3a61215b9745b6204963213399a087e1e2502d79de8d2b7194 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:9ce5157811f6d08cd803b1daad2b4d30cb1bf334a044b4676186321c322957f9 and below * is unaffected.

Red Hat Openshift Data Foundation 4.17:

Version sha256:a319b25a6d5deef4d0a0f365734d6be96fdd863962e36b306e9946521aec724c and below * is unaffected.