Privilege escalation in Red Hat Developer Hub
CVE-2025-5417
An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Red Hat Developer Hub — versions 0
- Red Hat Developer Hub 1.7 — versions sha256:aa3c5b50c65aee51b932fafcbf479ce54f15496cffc2744860bd9e135cce815c
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2025:14090 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2025-5417 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
Frequently asked questions
- What is CVE-2025-5417?
- CVE-2025-5417 is a medium-severity vulnerability in Red Hat Developer Hub, classified under Incorrect Privilege Assignment. CVSS score: 6.1/10. Published 2025-08-19.
- How severe is CVE-2025-5417?
- Medium severity. CVSS v3 base score is 6.1 out of 10.