CVE-2025-49842 - CVE House
Back to Database
Status published Low CVE-2025-49842

conda-forge-webservices Privilege Escalation Risk via Default Docker Root User

Vulnerability Description

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-49842

Credits & Attribution

No credits recorded in the NVD database.

References

More from conda-forge

View All →
CVE-2025-49843
conda-smithy Has Incorrect Default File Permissions
Low 2.7
CVE-2025-49824
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
Low 1.7
CVE-2025-49598
conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing
Medium 4.4
CVE-2025-35471
conda-forge openssl-feedstock writable OPENSSLDIR
High 7
CVE-2025-32784
conda-forge-webservices has an Unauthorized Artifact Modification Race Condition
High 7.5

Affected Vendor

conda-forge

View all reports →

Affected Software

conda-forge-webservices
Vulnerable Versions:
< 2025.3.24

Timeline

Official Publish: June 17th, 2025
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-276

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification
Defense Evasion
T1078 Valid Accounts
Persistence
T1574 Hijack Execution Flow
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1005 Data from Local System
Collection