The vulnerability arises because the /etc/passwd file is built with group‑writable permissions in Red Hat Process Automation Manager container images. An attacker who can run commands inside the container, even as a non‑root user, can take advantage of membership in the root group to modify this file. By adding a user entry with any arbitrary UID—including UID 0—the attacker gains full root privileges within the container. This is a classic privilege escalation flaw identified as CWE‑276.

The flaw affects Red Hat Process Automation Manager 7 container images (Red Hat Process Automation 7). Specific patch or version numbers are not provided in the advisory. All images built from the affected factory that include the vulnerable /etc/passwd permissions are impacted.

The CVSS score is 6.4, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitability requires the attacker to already execute code inside the container, which is a significant but not trivial prerequisite. Once inside, the elevated privileges can be achieved with minimal effort, making the exploit highly valuable if the initial access is gained.