An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, can access the rhdh/rhdh-hub-rhel9 container image and modify its content. This issue affects the confidentiality and integrity of the data, with changes resetting after the pod restarts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-5417 |
Exploitation
To exploit this vulnerability, an attacker with standard user access to the Red Hat Developer Hub can manipulate the rhdh/rhdh-hub-rhel9 container image. By leveraging their access, they can modify the image’s content, impacting the confidentiality and integrity of the data stored within the container.
Affected Products
- Red Hat Developer Hub: A platform for managing and deploying applications, which is vulnerable due to insufficient access controls.
Mitigation
To mitigate this vulnerability, it is recommended to review and restrict user access permissions within the Red Hat Developer Hub. Ensuring that only authorized users have the necessary privileges can help prevent unauthorized modifications to the container image.