Executive brief
A security flaw was found in the Multi-Cloud Object Gateway (NooBaa), a service used for managing data storage across different cloud providers. Due to incorrect file permissions within its software container, an attacker who already has limited access to the system could grant themselves full administrative control over that container. This could allow them to interfere with data operations or gain a deeper foothold within the cloud environment.
Technical details
A privilege escalation vulnerability exists in noobaa-core due to incorrect default permissions (CWE-276) assigned during the container image build process. Specifically, the /etc/passwd file (and potentially the entire /etc directory) is created with group-writable permissions (mode 664). An attacker who has already gained local command execution within the container and is a member of the root group can modify /etc/passwd to add a new user with UID 0. This allows the attacker to escalate from a non-root user to full root privileges within the container environment. The issue was identified in the setup_platform.sh script of the noobaa-core deployment.
Affected products
- NooBaa noobaa-core
- Red Hat OpenShift Data Foundation 4.0
Timeline
- 2025-08-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-13: advisory: CVE published by Red Hat