CVE-2025-12801

Katalog CVE

CVSS 6.5 · Medium EPSS 0,47%

Kerentanan Incorrect Execution-Assigned Permissions pada redhat openshift container platform, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

Rincian

Terbit di NVD

4 Maret 2026

Terakhir diubah

1 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-279: Incorrect Execution-Assigned Permissions
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:3938 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:3939 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:3940 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:3941 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:3942 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-12801 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2413081 issue tracking · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:5127
• https://access.redhat.com/errata/RHSA-2026:5606
• https://access.redhat.com/errata/RHSA-2026:5867
• https://access.redhat.com/errata/RHSA-2026:5873
• https://access.redhat.com/errata/RHSA-2026:5877