CVE-2025-7195: Operator-Framework Operator-SDK

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Affected products

Operator-Framework Operator-SDK: before 0.15.2 (fixed in 0.15.2)
Red Hat Multicluster Engine For Kubernetes
Red Hat Multicluster Engine For Kubernetes 2.6: before v2.6 (fixed in v2.6)
Red Hat Multicluster Engine For Kubernetes 2.7: before v2.7 (fixed in v2.7)
Red Hat Multicluster Engine For Kubernetes 2.8: before 1765872406 (fixed in 1765872406); before 1766360304 (fixed in 1766360304); before 1765669648 (fixed in 1765669648); before 1765866268 (fixed in 1765866268); before 1765872399 (fixed in 1765872399); before 1765872402 (fixed in 1765872402); …
Red Hat Multicluster Engine For Kubernetes 2.9: before v2.9 (fixed in v2.9)
Red Hat Multicluster Global Hub
Red Hat Openshift Compliance Operator 1: before 1.8.0 (fixed in 1.8.0); before 1768172669 (fixed in 1768172669)
Red Hat Openshift File Integrity Operator - Fio 1: before v1.3 (fixed in v1.3)
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.11: before v2.11 (fixed in v2.11)
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.12: before v2.12 (fixed in v2.12); before 1773285089 (fixed in 1773285089); before 1773259164 (fixed in 1773259164); before 1773259182 (fixed in 1773259182); before 1773358651 (fixed in 1773358651); before 1773090513 (fixed in 1773090513)
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.13: before 1767569821 (fixed in 1767569821); before 1767829032 (fixed in 1767829032); before 1767656229 (fixed in 1767656229)
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.14: before v2.14 (fixed in v2.14); before 1769720041 (fixed in 1769720041); before 1770343757 (fixed in 1770343757); before 1769721579 (fixed in 1769721579); before 1770336554 (fixed in 1770336554)
Red Hat Red Hat Advanced Cluster Security 4
Red Hat Red Hat Build Of Apicurio Registry 2
Red Hat Red Hat Build Of Apicurio Registry 3
Red Hat Red Hat Fuse 7
Red Hat Red Hat Openshift Container Platform 4
Red Hat Red Hat Openshift Data Foundation 4.14: before v4.14-1764178221 (fixed in v4.14-1764178221); before v4.14-1764178222 (fixed in v4.14-1764178222); before v4.14-1764178236 (fixed in v4.14-1764178236); before v4.14-1764178273 (fixed in v4.14-1764178273); before v4.14-1764178715 (fixed in v4.14-1764178715); before v4.14-1764178261 (fixed in v4.14-1764178261); …
Red Hat Red Hat Openshift Data Foundation 4.15: before v4.15-1764176261 (fixed in v4.15-1764176261); before v4.15-1764176342 (fixed in v4.15-1764176342); before v4.15-1764176372 (fixed in v4.15-1764176372); before v4.15-1764176892 (fixed in v4.15-1764176892); before v4.15-1764176485 (fixed in v4.15-1764176485); before v4.15-1764176698 (fixed in v4.15-1764176698); …
Red Hat Red Hat Openshift Data Foundation 4.16: before v4.16-1764168955 (fixed in v4.16-1764168955); before v4.16-1764169118 (fixed in v4.16-1764169118); before v4.16-1764169242 (fixed in v4.16-1764169242); before v4.16-1764169544 (fixed in v4.16-1764169544); before v4.16-1764169347 (fixed in v4.16-1764169347); before v4.16-1764169479 (fixed in v4.16-1764169479); …
Red Hat Red Hat Openshift Data Foundation 4.17: before v4.17-1764167834 (fixed in v4.17-1764167834); before v4.17-1764167795 (fixed in v4.17-1764167795); before v4.17-1764167826 (fixed in v4.17-1764167826); before v4.17-1764167876 (fixed in v4.17-1764167876); before v4.17-1764168179 (fixed in v4.17-1764168179); before v4.17-1764167987 (fixed in v4.17-1764167987); …
Red Hat Red Hat Openshift Data Foundation 4.18: before v4.18-1761854289 (fixed in v4.18-1761854289); before v4.18-1761854280 (fixed in v4.18-1761854280); before v4.18-1761854319 (fixed in v4.18-1761854319); before v4.18-1761855549 (fixed in v4.18-1761855549); before v4.18-1761854321 (fixed in v4.18-1761854321); before v4.18-1761854422 (fixed in v4.18-1761854422); …
Red Hat Red Hat Openshift Virtualization 4
and 4 more

Published 2025-08-07. Last modified 2026-09-21.