The flaw arises because the /etc/passwd file inside certain Red Hat Ansible Automation Platform 2 container images is created with group‑writable permissions during build. When an attacker can execute commands inside the container, even as a non‑root user, and is a member of the root group, the attacker can modify the passwd file. By adding a new entry with an arbitrary UID, including UID 0, the attacker gains full root privileges inside the container. This is a classic example of unauthorized privilege escalation, classified as CWE‑276.

The vulnerability applies to Red Hat Ansible Automation Platform version 2 container images. No specific patch or version numbers are provided in the data, so any impacted image that was built with the described permission setting is at risk.

The CVSS score of 6.4 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who has the ability to run commands inside the affected container and is a member of the root group. The attacker can exploit the permission error to edit /etc/passwd and add a privileged user, leading to full container root access. The risk is therefore significant for deployments where containers run with group root access or where users can elevate their privileges within the container runtime.