CVE-2025-3528

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.

• CWE-276

• https://access.redhat.com/errata/RHBA-2025:9645
• https://access.redhat.com/security/cve/CVE-2025-3528
• https://bugzilla.redhat.com/show_bug.cgi?id=2359143

Published

May 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3522Thunderbird processes the X-Mozilla-External-Attachment-URL …6.3
• CVE-2025-3523When an email contains multiple attachments with external li…6.4
• CVE-2025-3524Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-3525GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-3526SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and …7.5
• CVE-2025-3527The EventON Pro plugin for WordPress is vulnerable to unauth…5.4
• CVE-2025-3529The WordPress Simple Shopping Cart plugin for WordPress is v…8.2
• CVE-2025-3530The WordPress Simple Shopping Cart plugin for WordPress is v…7.5
• CVE-2025-3531A vulnerability classified as problematic has been found in …6.1
• CVE-2025-3532A vulnerability classified as problematic was found in YouDi…6.1
• CVE-2025-3533A vulnerability, which was classified as problematic, has be…6.1
• CVE-2025-3534A vulnerability, which was classified as critical, was found…6.3