CVE-2025-12985CWE-732

License Service: Privilege escalation vulnerability

High · published January 20, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

⚡ Oops! A local root escalation flaw allows anyone inside the IBM Licensing Operator container to access security-critical files, like a chef raiding a pantry they shouldn't have access to! 🍽️ Imagine a restaurant where the head chef has a key to the vault where the secret recipes are kept, but the sous-chef can waltz in without anyone checking credentials — that's the kind of access this flaw allows! An attacker with local access to the container can exploit this vulnerability to gain root privileges, potentially leading to unauthorized access to sensitive data and manipulation of critical system files. It’s a recipe for disaster that could compromise the entire system's integrity!

Put simply

Imagine a restaurant where the head chef has a key to the vault where the secret recipes are kept, but the sous-chef can waltz in without anyone checking credentials — that's the kind of access this flaw allows! This vulnerability stems from improperly assigned privileges to security-sensitive files in the IBM Licensing Operator image, allowing local users to escalate their permissions within the container.

What to do

An attacker with local access to the container can exploit this vulnerability to gain root privileges, potentially leading to unauthorized access to sensitive data and manipulation of critical system files. It’s a recipe for disaster that could compromise the entire system's integrity! To remediate this issue, update to the latest version of the IBM Licensing Operator to ensure proper privilege assignments. Additionally, audit your containers' access controls to prevent unauthorized access. Implementing strong container security practices is crucial! You've got this! By taking these steps, you'll secure your container environment and strengthen your defenses! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-01-20T14:50Z
EPSS history
Timeline
  • 20 JAN 14:50Z
    License Service: Privilege escalation vulnerability
    cvelistv5