Vulnerability in Red Hat Openshift Data Foundation 4
CVE-2025-8766
A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attack…
EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Data Foundation 4.22 — versions 1782932114, 1782931768, 1782932104
- Redhat Openshift_data_foundation — versions 4.0
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, Third Party Advisory, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Third Party Advisory)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2025-8766?
- CVE-2025-8766 is a medium-severity vulnerability in Red Hat Openshift Data Foundation 4, classified under Incorrect Default Permissions. CVSS score: 6.4/10. Published 2026-03-13.
- How severe is CVE-2025-8766?
- Medium severity. CVSS v3 base score is 6.4 out of 10.