CVE-2025-5417: Rhdh: red hat developer hub user permissions
An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.
Other sources
Insufficient access control vulnerability has been detected in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster and the Red Hat Developer Hub namespace, is able to get access to the rhdh/rhdh-hub-rhel9 container image and modify the content of the image, which impacts the Confidentiality and Integrity of the data. Made changes are not permanent and are reset after the pod restart.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5417?
The CVE-2025-5417 vulnerability has been classified as a medium severity due to its potential impact on access control.
How do I fix CVE-2025-5417?
To fix CVE-2025-5417, apply the latest patches provided by Red Hat for the Developer Hub.
Who is affected by CVE-2025-5417?
CVE-2025-5417 affects users of the Red Hat Developer Hub with standard user access to the cluster and namespace.
What type of vulnerability is CVE-2025-5417?
CVE-2025-5417 is an insufficient access control vulnerability.
What can happen if CVE-2025-5417 is exploited?
If exploited, CVE-2025-5417 may allow unauthorized access to sensitive resources in the Red Hat Developer Hub.