Ansible Automation Platform images: group-writable /etc/passwd lets a container user become root in-container

Impact

Affected AAP images ship /etc/passwd group-writable, and container processes are members of the root group. Anyone who can already execute commands in the container, even as a non-root user, can append a UID 0 entry and become root inside that container. This does not cross the container boundary by itself, but AAP execution environments are where fleet automation holds vault passwords, SSH keys and cloud credentials, and root inside the EE reads all of them plus any mounted secret. Treat it as a defense-in-depth failure that turns a limited foothold into full control of an automation run, not as an entry point.

Who can reach it

A user who can already run commands inside an affected AAP container image. Local to the container and authenticated; the record scores high privileges required and high attack complexity.

What to do

Pull the rebuilt images from RHSA-2026:42141 / RHSA-2026:42144 and restart the affected pods or execution environments. Rotate credentials that were exposed to any container an untrusted party could reach. No host reboot or node drain.

References

Related entries

• galaxy_ng: namespace avatar URL is fetched unchecked, giving SSRF into internal and metadata endpointsCVE-2026-79717 · galaxy_ng (Ansible Galaxy / Automation Hub server, namespace avatar fetch worker)Medium
• AWX bulk job launch: read-level permission on an instance group is enough to run jobs on itCVE-2026-84470 · Ansible Automation Platform automation-controller (AWX) Bulk Job Launch APIMedium
• Vertiv Avocent UMG-4000 universal management gateway: An authenticated admin can plant a maliciously named fileCVE-2019-9508 · Vertiv Avocent UMG-4000 universal management gatewayMedium
• Slurm (openSUSE slurm-testsuite packaging): The openSUSE slurm testsuite package ships files with permissive defaultCVE-2022-31251 · Slurm (openSUSE slurm-testsuite packaging)Medium
• Cisco UCS Central Software (weak backup encryption): Weak encryption on full-state and configuration backups meansCVE-2024-20280 · Cisco UCS Central Software (weak backup encryption)Medium
• Dell OpenManage Enterprise (credential disclosure): A low-privileged local user obtains stored credentials from OMECVE-2024-28961 · Dell OpenManage Enterprise (credential disclosure)Medium