https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:10:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373052 EUVD-2026-373052 https://cve.radiocsirt.org/vuln/euvd-2026-373052 https://cve.radiocsirt.org/vuln/fkie_cve-2025-7195 <p>Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.</p> <p>In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.</p> <p>Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images.</p> <p>In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-7195 https://cve.radiocsirt.org/vuln/ghsa-856v-8qm2-9wjv <p><strong>Affected:</strong> Go: github.com/operator-framework/operator-sdk</p> <p>Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file was created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.</p> <p><strong>Affected:</strong> Go: github.com/operator-framework/operator-sdk</p> <p>Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file was created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.</p> https://cve.radiocsirt.org/vuln/ghsa-856v-8qm2-9wjv https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 https://cve.radiocsirt.org/vuln/rhea-2025:23406 <p>operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd</p> <p>operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd</p> https://cve.radiocsirt.org/vuln/rhea-2025:23406 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2533 <p>Ein lokaler Angreifer kann eine Schwachstelle in RedHat Multicluster Engine for Kubernetes ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in RedHat Multicluster Engine for Kubernetes ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2533