An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, can access and modify the image’s content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-5417 |
Exploitation
To exploit this vulnerability, an attacker with standard user access to the Red Hat Developer Hub can manipulate the rhdh/rhdh-hub-rhel9 container image. By accessing the image, they can modify its content, which could lead to unauthorized changes affecting the data’s confidentiality and integrity.
Affected Products
- Red Hat Developer Hub: A platform for managing and deploying applications, which is vulnerable due to insufficient access controls in the rhdh/rhdh-hub-rhel9 container image.
Mitigation
To mitigate this vulnerability, it is recommended to implement stricter access controls for the Red Hat Developer Hub container images. Ensuring that only authorized users have the necessary permissions can help prevent unauthorized modifications.