An integrity flaw (CWE‑276) allows an attacker with command execution capability inside a Multi‑Cloud Object Gateway Core container to modify the /etc/passwd file because it is created group‑writable during image build. By changing the file to add an entry with UID 0, the attacker gains full root privileges within the container.

The flaw affects Red Hat Openshift Data Foundation 4, specifically the Multi‑Cloud Object Gateway Core images. No specific affected version numbers are listed in the CVE entry.

The CVSS score of 6.4 denotes moderate severity, and the EPSS score of less than 1% indicates a low likelihood of active exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires that the attacker already have command execution within the container and membership in the root group; the attack vector is therefore local to the container environment, though it may be leveraged to compromise the host or other containers.