CVE-2025-57847 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for containerized environments using Red Hat Ansible Automation Platform, especially those with medium to high risk tolerance for privilege escalation attacks

Why it matters

CVE-2025-57847 is a medium-severity vulnerability affecting certain Red Hat Ansible Automation Platform images. It allows for container privilege escalation, potentially enabling attackers to gain root privileges within containers. System administrators and security teams should assess exposure, especially in environments with high risk tolerance for privilege escalation attacks. The vulnerability requires verification of current container configurations, application of patches or updates provided by Red Hat, and implementation of additional monitoring and logging.

• Potential lateral movement within containerized environments
• Elevation of privileges for attackers within affected containers
• Possible disruption of containerized services and applications
• Need for verification of current container configurations and permissions

Technical summary

The vulnerability arises from the /etc/passwd file being created with group-writable permissions during the build process of certain Red Hat Ansible Automation Platform images. This allows an attacker who can execute commands within an affected container, even as a non-root user, to leverage their membership in the root group to modify the /etc/passwd file. The attacker can add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.

Defensive priority

Medium priority for containerized environments using affected Red Hat Ansible Automation Platform images

Recommended defensive actions

• Review and update container configurations to ensure proper permissions on sensitive files
• Implement additional monitoring and logging for containerized environments
• Apply patches or updates provided by Red Hat for Ansible Automation Platform
• Verify and restrict access to container execution and root group membership
• Perform vulnerability assessment to identify potential exposure
• Inventory containerized environments for affected systems
• Track remediation progress and verify evidence of successful mitigation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has released several errata related to this issue (RHSA-2026:42141, RHSA-2026:42144, RHSA-2026:66482). Limited source detail is available; defenders should verify current container configurations, permissions, and patches. Evidence limits prevent further exploitation details. Defensive verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.