Security readout for executives and security teams
Plain-English summary
This flaw can let someone who already has command execution inside an affected Red Hat ODF container become root inside that container. It is not a remote break-in by itself, but it can worsen an existing container compromise or insider misuse.
Executive priority
Treat as a focused container hardening and patching item, not an internet-scale emergency. Prioritize clusters where many administrators, CI jobs, or operators can execute commands inside ODF containers.
Technical view
Affected Multi-Cloud Object Gateway Core-related Red Hat ODF 4.22 images created /etc/passwd with group-writable permissions. A non-root process in the root group could modify passwd and add a UID 0 account, gaining root privileges within the container.
Likely exposure
Exposure is likely limited to Red Hat OpenShift Data Foundation 4.22 environments using the affected odf4 RHEL9 container packages listed by Red Hat, including mcg-core-rhel9 and related ODF components.
Exploitation context
The CVSS vector is local, high complexity, and high privileges required. The bundle does not indicate KEV listing or active exploitation. An attacker first needs command execution inside an affected container under the right group conditions.
Researcher notes
The key condition is writable /etc/passwd by a non-root process with root-group membership. Evidence provided names affected Red Hat ODF 4.22 container packages, but does not include exact fixed versions or exploitation in the wild.
Mitigation direction
- Review RHSA-2026:37387 and Red Hat CVE guidance for fixed ODF images.
- Update affected Red Hat ODF 4.22 container images when vendor-fixed builds are available.
- Restrict who can exec into ODF and MCG pods or administer workloads.
- Redeploy affected workloads after image updates so corrected containers are running.
- Monitor affected containers for unexpected passwd changes or UID 0 accounts.
Validation and detection
- Inventory Red Hat ODF 4.22 clusters and compare image versions against the affected list.
- Confirm whether mcg-core-rhel9 or related odf4 RHEL9 images are deployed.
- Check affected running containers for group-writable /etc/passwd permissions.
- Review Kubernetes RBAC for users allowed to run commands in ODF pods.
- Verify updated containers no longer have group-writable passwd permissions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-8766 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H0.55.9redhatCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H0.55.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Reported to Red Hat.
- Source timelineredhat
Reported to Red Hat.
- ADP timelineredhat-SADP
Made public.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-08-08T16:08:17.737Z: Reported to Red Hat.
- 2026-03-13T02:37:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:37387CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-8766CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2387265CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8766.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.