CVE-2024-9486

VM images built with Image Builder and Proxmox provider use default credentials

State: Published
Severity: 9.8 Critical
Published: Oct 15, 2024
Updated: Oct 16, 2024
Reserved: Oct 3, 2024

Description

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	kubernetes

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
Image BuilderKubernetes	0.1.37 and earlierAffected 0.1.38Not affected

References

https://github.com/kubernetes/kubernetes/issues/128006vendor-advisoryissue-tracking
https://github.com/kubernetes-sigs/image-builder/pull/1595patch
https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.