--- id: CVE-2025-57847 title: >- A container privilege escalation flaw was found in certain Ansible Automation Platform images summary: >- A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an … severity: medium cvss: 6.4 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-276 vendor: redhat product: ansible_automation_platform affected: - ansible_automation_platform <= 2.6 patched: - ansible_automation_platform 2.16 - ansible_automation_platform 2.18 - ansible_automation_platform 2.5 published: '2026-04-08' updated: '2026-09-24' sourceUpdated: '2026-09-24T07:16:30.817' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-57847' references: - url: 'https://access.redhat.com/errata/RHSA-2026:42141' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42144' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66482' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66485' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66486' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66487' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:67279' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71177' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71179' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71192' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71210' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-57847' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2391092' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-57847.json - url: 'https://www.cve.org/CVERecord?id=CVE-2025-57847' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-57847' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-04-08T15:42:54.958669Z' epss: 0.00179 epssPercentile: 0.06686 ingestedAt: '2026-08-07T15:14:27.684Z' --- ## Overview A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container. ## Affected - `ansible_automation_platform <= 2.6` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:66485** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66485) - **RHSA-2026:66482** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66482) - **RHSA-2026:66487** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66487) - **RHSA-2026:66486** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66486) - **RHSA-2026:42144** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42144) - **RHSA-2026:42141** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42141) - **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2 · no fix planned: Red Hat Ansible Automation Platform 2 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-57847.json) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71192** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71192) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **RHSA-2026:71177** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71177)