Due to a bug in rpm-ostree, the /etc/shadow, /etc/shadow-, /etc/gshadow and /etc/gshadow- files in Fedora CoreOS, IoT, Atomic Desktops have the world-readable bit set. Affected versions All Fedora CoreOS nodes installed starting from the following versions are impacted: stable: 38.20230902.3.0 testing: 38.20230902.2.1 next: 38.20230902.1.1 Fedora IoT and Fedora Atomic Desktops (Silverblue, Kinoite, Sway Atomic, Budgie Atomic) systems that were installed from Fedora 39 and later release media...

Current Fedora versions that were installed as Fedora 39 are affected.

It you used an rpm-ostree version of Fedora since it was on 38 or below, and upgraded to 39, you are not affected.

The update with the fix rolls out today. As a workaround you can use this

sudo chmod --verbose 0000 /etc/shadow /etc/gshadow /etc/shadow- /etc/gshadow-

It is recommended to change all credentials stored there, i.e. at least your user(s) password(s).