Vulnerabilities in pkg:golang/github.com/operator-framework/operator-sdk

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-856v-8qm2-9wjv",
  "modified" : "2026-03-24T15:30:24Z",
  "published" : "2025-08-07T21:31:08Z",
  "aliases" : [ "CVE-2025-7195" ],
  "summary" : "operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd",
  "details" : "Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file was created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/operator-framework/operator-sdk"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.15.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-7195"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/operator-framework/operator-sdk"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2376300"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2025-7195"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:5633"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2572"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0737"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0722"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0718"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0627"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:23542"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:23529"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:23528"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22684"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22683"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22420"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22418"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22416"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:22415"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:21885"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:21368"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:19961"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:19958"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:19335"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:19332"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHEA-2026:0129"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHEA-2025:23478"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHEA-2025:23406"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHBA-2024:11569"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-276" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-08-07T21:59:46Z",
    "nvd_published_at" : "2025-08-07T19:15:29Z"
  }
}