CVE-2025-5417
Rhdh: red hat developer hub user permissions
- State
- Published
- Severity
- 6.1 Medium
- Published
- Aug 19, 2025
- Updated
- Dec 19, 2025
- Reserved
- May 31, 2025
Description
An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | redhat |
Weaknesses
- CWE-266 Incorrect Privilege Assignment
Affected Products
| Product | Versions |
|---|---|
Red Hat Developer HubRed Hat |
|
Red Hat Developer Hub 1.7Red Hat |
|
References
- RHSA-2025:14090vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-5417vdb-entry
- RHBZ#2369602issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.