Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

Summary

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Timeline

1. Aug 7, 2025, 7:05 PM UTCCVE published
2. Aug 7, 2025, 7:23 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 21, 2026, 5:17 PM UTCRecord last updated

Affected versions

• operator-sdk

  fixed in 0.15.2

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• multicluster-engine/addon-manager-rhel9

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel9

  Version range not reported

• multicluster-engine/discovery-rhel9

  Version range not reported

• multicluster-engine/placement-rhel9

  Version range not reported

• multicluster-engine/registration-operator-rhel9

  Version range not reported

• multicluster-engine/registration-rhel9

  Version range not reported

• multicluster-engine/work-rhel9

  Version range not reported

• multicluster-engine/addon-manager-rhel9

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel9

  Version range not reported

• multicluster-engine/discovery-rhel9

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel9

  Version range not reported

• multicluster-engine/placement-rhel9

  Version range not reported

• multicluster-engine/registration-operator-rhel9

  Version range not reported

• multicluster-engine/registration-rhel9

  Version range not reported

• multicluster-engine/work-rhel9

  Version range not reported

• multicluster-engine/addon-manager-rhel9

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel9

  Version range not reported

• multicluster-engine/discovery-rhel9

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel9

  Version range not reported

• multicluster-engine/placement-rhel9

  Version range not reported

• multicluster-engine/registration-operator-rhel9

  Version range not reported

• multicluster-engine/registration-rhel9

  Version range not reported

• multicluster-engine/work-rhel9

  Version range not reported

• multicluster-engine/addon-manager-rhel9

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel9

  Version range not reported

• multicluster-engine/discovery-rhel9

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel9

  Version range not reported

• multicluster-engine/placement-rhel9

  Version range not reported

• multicluster-engine/registration-operator-rhel9

  Version range not reported

• multicluster-engine/registration-rhel9

  Version range not reported

• multicluster-engine/work-rhel9

  Version range not reported

• multicluster-engine/addon-manager-rhel9

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel9

  Version range not reported

• multicluster-engine/discovery-rhel9

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel9

  Version range not reported

• multicluster-engine/placement-rhel9

  Version range not reported

• multicluster-engine/registration-operator-rhel9

  Version range not reported

• multicluster-engine/registration-rhel9

  Version range not reported

• multicluster-engine/work-rhel9

  Version range not reported

• compliance/openshift-compliance-rhel8-operator

  Version range not reported

• compliance/openshift-compliance-rhel8-operator

  Version range not reported

• compliance/openshift-file-integrity-rhel8-operator

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/multicluster-operators-application-rhel9

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• rhacm2/acm-cluster-permission-rhel9

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/multicloud-integrations-rhel9

  Version range not reported

• rhacm2/multicluster-operators-application-rhel9

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/acm-cluster-permission-rhel9

  Version range not reported

• rhacm2/multicloud-integrations-rhel9

  Version range not reported

• rhacm2/multicluster-operators-application-rhel9

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• rhacm2/acm-cluster-permission-rhel9

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/acm-cluster-permission-rhel9

  Version range not reported

• rhacm2/cluster-backup-rhel9-operator

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/acm-cluster-permission-rhel9

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel9

  Version range not reported

• rhacm2/multicloud-integrations-rhel9

  Version range not reported

• rhacm2/multicluster-operators-application-rhel9

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• rhacm2/multicloud-integrations-rhel9

  Version range not reported

• rhacm2/multicluster-operators-application-rhel9

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• odf4/cephcsi-rhel9

  Version range not reported

• odf4/mcg-cli-rhel9

  Version range not reported

• odf4/mcg-core-rhel9

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/ocs-client-rhel9-operator

  Version range not reported

• odf4/ocs-metrics-exporter-rhel9

  Version range not reported

• odf4/ocs-rhel9-operator

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-cosi-sidecar-rhel9

  Version range not reported

• odf4/odf-csi-addons-rhel9-operator

  Version range not reported

• odf4/odf-csi-addons-sidecar-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/odf-multicluster-rhel9-operator

  Version range not reported

• odf4/odf-must-gather-rhel9

  Version range not reported

• odf4/odf-rhel9-operator

  Version range not reported

• odf4/odr-rhel9-operator

  Version range not reported

• odf4/rook-ceph-rhel9-operator

  Version range not reported

• odf4/cephcsi-rhel9

  Version range not reported

• odf4/mcg-core-rhel9

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/ocs-client-rhel9-operator

  Version range not reported

• odf4/ocs-metrics-exporter-rhel9

  Version range not reported

• odf4/ocs-rhel9-operator

  Version range not reported

• odf4/odf-cli-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-cosi-sidecar-rhel9

  Version range not reported

• odf4/odf-csi-addons-rhel9-operator

  Version range not reported

• odf4/odf-csi-addons-sidecar-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/odf-multicluster-rhel9-operator

  Version range not reported

• odf4/odf-must-gather-rhel9

  Version range not reported

• odf4/odf-rhel9-operator

  Version range not reported

• odf4/odr-rhel9-operator

  Version range not reported

• odf4/rook-ceph-rhel9-operator

  Version range not reported

• odf4/cephcsi-rhel9

  Version range not reported

• odf4/mcg-core-rhel9

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/ocs-client-rhel9-operator

  Version range not reported

• odf4/ocs-metrics-exporter-rhel9

  Version range not reported

• odf4/ocs-rhel9-operator

  Version range not reported

• odf4/odf-cli-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-cosi-sidecar-rhel9

  Version range not reported

• odf4/odf-csi-addons-rhel9-operator

  Version range not reported

• odf4/odf-csi-addons-sidecar-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/odf-multicluster-rhel9-operator

  Version range not reported

• odf4/odf-must-gather-rhel9

  Version range not reported

• odf4/odf-rhel9-operator

  Version range not reported

• odf4/odr-rhel9-operator

  Version range not reported

• odf4/rook-ceph-rhel9-operator

  Version range not reported

• odf4/cephcsi-rhel9

  Version range not reported

• odf4/cephcsi-rhel9-operator

  Version range not reported

• odf4/mcg-core-rhel9

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/ocs-client-rhel9-operator

  Version range not reported

• odf4/ocs-metrics-exporter-rhel9

  Version range not reported

• odf4/ocs-rhel9-operator

  Version range not reported

• odf4/odf-cli-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-cosi-sidecar-rhel9

  Version range not reported

• odf4/odf-csi-addons-rhel9-operator

  Version range not reported

• odf4/odf-csi-addons-sidecar-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/odf-multicluster-rhel9-operator

  Version range not reported

• odf4/odf-must-gather-rhel9

  Version range not reported

• odf4/odf-rhel9-operator

  Version range not reported

• odf4/odr-rhel9-operator

  Version range not reported

• odf4/rook-ceph-rhel9-operator

  Version range not reported

• odf4/cephcsi-rhel9

  Version range not reported

• odf4/cephcsi-rhel9-operator

  Version range not reported

• odf4/mcg-core-rhel9

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/ocs-client-rhel9-operator

  Version range not reported

• odf4/ocs-metrics-exporter-rhel9

  Version range not reported

• odf4/ocs-rhel9-operator

  Version range not reported

• odf4/odf-cli-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-cosi-sidecar-rhel9

  Version range not reported

• odf4/odf-csi-addons-rhel9-operator

  Version range not reported

• odf4/odf-csi-addons-sidecar-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/odf-multicluster-rhel9-operator

  Version range not reported

• odf4/odf-must-gather-rhel9

  Version range not reported

• odf4/odf-rhel9-operator

  Version range not reported

• odf4/odr-rhel9-operator

  Version range not reported

• odf4/rook-ceph-rhel9-operator

  Version range not reported

• multicluster-engine/addon-manager-rhel8

  Version range not reported

• multicluster-engine/clusterlifecycle-state-metrics-rhel8

  Version range not reported

• multicluster-engine/discovery-rhel8

  Version range not reported

• multicluster-engine/hypershift-addon-rhel8-operator

  Version range not reported

• multicluster-engine/hypershift-addon-rhel9-operator

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel8

  Version range not reported

• multicluster-engine/placement-rhel8

  Version range not reported

• multicluster-engine/registration-operator-rhel8

  Version range not reported

• multicluster-engine/registration-rhel8

  Version range not reported

• multicluster-engine/work-rhel8

  Version range not reported

• multicluster-globalhub/multicluster-globalhub-agent-rhel9

  Version range not reported

• multicluster-globalhub/multicluster-globalhub-manager-rhel9

  Version range not reported

• multicluster-globalhub/multicluster-globalhub-rhel9-operator

  Version range not reported

• rhacm2/acm-cluster-permission-rhel8

  Version range not reported

• rhacm2/acm-governance-policy-framework-addon-rhel9

  Version range not reported

• rhacm2/cert-policy-controller-rhel9

  Version range not reported

• rhacm2/config-policy-controller-rhel9

  Version range not reported

• rhacm2/endpoint-monitoring-rhel9-operator

  Version range not reported

• rhacm2/governance-policy-propagator-rhel9

  Version range not reported

• rhacm2/grafana-dashboard-loader-rhel9

  Version range not reported

• rhacm2/iam-policy-controller-rhel9

  Version range not reported

• rhacm2/klusterlet-addon-controller-rhel8

  Version range not reported

• rhacm2/metrics-collector-rhel9

  Version range not reported

• rhacm2/multicloud-integrations-rhel8

  Version range not reported

• rhacm2/multicluster-observability-rhel9-operator

  Version range not reported

• rhacm2/multicluster-operators-application-rhel8

  Version range not reported

• rhacm2/multicluster-operators-channel-rhel8

  Version range not reported

• rhacm2/rbac-query-proxy-rhel9

  Version range not reported

• rhacm2/search-collector-rhel9

  Version range not reported

• advanced-cluster-security/rhacs-rhel8-operator

  Version range not reported

• apicurio/apicurio-registry-rhel8-operator

  Version range not reported

• apicurio/apicurio-registry-rhel8-operator

  Version range not reported

• fuse7/fuse-apicurito-rhel8-operator

  Version range not reported

• compliance/openshift-compliance-rhel8-operator

  Version range not reported

• openshift4/cnf-tests-rhel8

  Version range not reported

• openshift4/cnf-tests-rhel9

  Version range not reported

• openshift4/lifecycle-agent-operator-bundle

  Version range not reported

• openshift4/topology-aware-lifecycle-manager-operator-bundle

  Version range not reported

• openshift4/ztp-site-generate-rhel8

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status-rhel9

  Version range not reported

• web-terminal/web-terminal-exec-rhel9

  Version range not reported

• web-terminal/web-terminal-rhel9-operator

  Version range not reported

• github.com/operator-framework/operator-sdkGo

  fixed in 0.15.2

References 25