CVE-2025-57847 Red Hat CVE debrief

Who should care

Security teams and administrators responsible for managing and securing Ansible Automation Platform environments should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability exists in certain Ansible Automation Platform images due to the /etc/passwd file being created with group-writable permissions. An attacker who can execute commands within an affected container can leverage their membership in the root group to modify the /etc/passwd file, allowing them to add a new user with arbitrary UID, including UID 0, and gain full root privileges within the container.

Defensive priority

Medium priority given the CVSS score of 6.4 and the potential impact of privilege escalation within containers.

Recommended defensive actions

• Review and update Ansible Automation Platform images to ensure the /etc/passwd file is created with secure permissions.
• Implement compensating controls, such as monitoring and restricting access to sensitive files and directories.
• Apply patches or updates provided by the vendor to address the vulnerability.
• Conduct regular vulnerability assessments and penetration testing to identify potential weaknesses.
• Enforce least privilege principles and restrict user access to sensitive resources.

Evidence notes

The CVE record was published on 2026-04-08T14:16:25.577Z and was last modified on 2026-07-21T06:16:27.860Z. The NVD entry is currently Modified. Evidence is limited to public CVE and NVD information. Defenders should verify affected systems exist, review official advisories, and plan updates or mitigations. Compensating controls and monitoring should be reviewed for exposed systems. Exceptions should be tracked and remediated assets retested.

Official resources