A flaw during the construction of certain Multicluster Engine for Kubernetes images creates the /etc/passwd file as writable by the root group. An attacker with the ability to execute commands inside the container, even as a non‑root user, and who is a member of the root group, can modify this file. By inserting a new user entry with a chosen UID—particularly UID 0—the attacker can gain full root privileges within the container, enabling arbitrary code execution and data tampering inside the container environment.

The vulnerability applies to all Red Hat Multicluster Engine for Kubernetes images that include the group‑writable /etc/passwd. No specific product version information was supplied, so any image of this product lacking the patch remains vulnerable.

With a CVSS score of 6.4, the issue is considered medium severity. Exploitation requires the attacker to have some level of command execution within the container and membership in the root group; no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. While the attack is limited to containers with writable group permissions on /etc/passwd, gaining container root access poses a significant risk to the confidentiality, integrity, and availability of the containerized workloads.