CVE Alert: CVE-2025-36193 – IBM – Transformation Advisor

Risk verdict

High risk of local privilege escalation within the IBM Transformation Advisor container if unpatched; no active exploitation signals observed at present.

Why this matters

Compromise could yield root access inside the container, enabling tampering with transformation workflows, access to sensitive configuration or secrets, and potential container breakout. In enterprise deployments, this raises the risk of further cluster compromise, data integrity issues and disruption of automated transformation pipelines.

Most likely attack path

An attacker with local access to the host or pod could exploit insecure file permissions in security‑critical paths inside the operator image to gain root inside the container. As privileges are listed as NONE and the vector is LOCAL, exploitation hinges on misconfigured permissions rather than user credentials, making idle systems at risk if containers run with elevated defaults or privileged settings. Lateral movement would depend on the attacker’s ability to access additional pods, shared volumes, or cluster-wide admin capabilities.

Who is most exposed

Organisations deploying Transformation Advisor via the OpenShift/Kubernetes operator catalog, especially where pods run as root, use privileged containers, or mount host‑level volumes.

Detection ideas

• Scan for world-writable or overly permissive files in the operator’s image/filesystem.
• Monitor pods for root-owned processes and unusual privilege escalations.
• Inspect security contexts, capabilities, and any privileged or hostPath volume usage.
• Audit changes to security-sensitive files within the operator namespace.
• Look for unexpected container restarts or root shell activity within the affected pods.

Mitigation and prioritisation

• Apply the vendor fix: upgrade to v4.3.2 or newer immediately.
• Enforce least privilege: run pods as non-root, drop capabilities, and avoid privileged containers.
• Use image scanning and signing; restrict to trusted images and proper baselines.
• Implement PSP/OPA Gatekeeper controls to enforce non-root and restricted volumes.
• Change-management: test patch in staging, schedule a controlled production rollout; monitor closely after patch.
• If KEV is present or EPSS ≥ 0.5, treat as priority 1. Currently no KEV flag and EPSS not provided.