CVE-2025-3528

HIGH 8.2

Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.

CWE	CWE-276
Published	May 9, 2025
Last Updated	Feb 27, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Red Hat / MIRROR-REGISTRY-2.0-RHEL-8

All versions affected

Red Hat / mirror registry for Red Hat OpenShift

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHBA-2025:9645 access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-3528 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2359143

Credits

Red Hat would like to thank Antony Di Scala and Mike Whale for reporting this issue.