Ansible Automation Platform images: group-writable /etc/passwd lets a container user become root in-container

Impact

Affected AAP images ship /etc/passwd group-writable, and container processes are members of the root group. Anyone who can already execute commands in the container, even as a non-root user, can append a UID 0 entry and become root inside that container. This does not cross the container boundary by itself, but AAP execution environments are where fleet automation holds vault passwords, SSH keys and cloud credentials, and root inside the EE reads all of them plus any mounted secret. Treat it as a defense-in-depth failure that turns a limited foothold into full control of an automation run, not as an entry point.

Who can reach it

A user who can already run commands inside an affected AAP container image. Local to the container and authenticated; the record scores high privileges required and high attack complexity.

What to do

Pull the rebuilt images from RHSA-2026:42141 / RHSA-2026:42144 and restart the affected pods or execution environments. Rotate credentials that were exposed to any container an untrusted party could reach. No host reboot or node drain.

References