CVE-2025-12801 - CVE House
Back to Database
Status published Medium CVE-2025-12801

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Vulnerability Description

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12801

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Red Hat would like to thank Simon Hall for reporting this issue.

References

More from Red Hat

View All →
CVE-2025-9909
Aap-gateway: improper path validation in gateway allows credential exfiltration
Medium 6.7
CVE-2025-9908
Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
Medium 6.7
CVE-2025-9907
Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
Medium 6.7
CVE-2025-9901
Libsoup: improper handling of http vary header in libsoup caching
Medium 5.9
CVE-2025-9820
Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function
Medium 4

Affected Vendor

Affected Software

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat Ceph Storage 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Vulnerable Versions:
1:2.8.3-0.el10_1.3, 1:2.3.3-68.el8_10, 1:2.5.4-38.el9_7.3, 1:2.5.4-26.el9_4.3, 1:2.5.4-34.el9_6.3, 416.94.202603231244-0, 417.94.202603242359-0, 418.94.202603181125-0, 4.19.9.6.202603251941-0, 1774002867

Timeline

Official Publish: March 4th, 2026
Last Modified: June 29th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-279

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.