Executive brief
Red Hat Web Terminal provides a web-based terminal interface for managing OpenShift clusters. A security flaw in certain container images allows a user with limited access to gain full administrative (root) control over the container. This could allow an attacker to bypass security restrictions and manipulate the container environment.
Technical details
A privilege escalation vulnerability exists in Red Hat Web Terminal container images due to incorrect default permissions (CWE-276). During the image build process, the /etc/passwd file is created with group-writable permissions. An attacker who can execute commands within the container and is a member of the root group can modify /etc/passwd to add a new user with UID 0. This allows the attacker to escalate privileges from a non-root user to full root access within the container environment. The attack requires local access and specific preconditions regarding group membership.
Affected products
- Red Hat Web Terminal 1
Timeline
- 2025-08-26: other: Bug reported in Red Hat Bugzilla
- 2026-04-08: disclosed: CVE published by Red Hat