A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Virtual machine images built using the Nutanix or the OVA provider do not disable these default credentials, allowing nodes using these images to be accessible via these credentials. This can lead to unauthorized root access on affected Kubernetes clusters.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7342 |
Exploitation
To exploit this vulnerability, an attacker would need to access a Kubernetes cluster that uses Windows nodes with VM images created via the Image Builder project with the Nutanix or OVA provider. By leveraging the default credentials, the attacker could gain root access to the nodes, potentially compromising the entire cluster.
Affected Products
- Kubernetes Image Builder: The tool used to create VM images that may have default credentials enabled.
- Nutanix Provider: A specific provider for building VM images that does not disable default credentials.
- OVA Provider: Another provider for VM images that also fails to disable default credentials.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that any VM images created using the Kubernetes Image Builder with the Nutanix or OVA provider have default credentials disabled. Regular audits and updates of the images used in Kubernetes clusters can help prevent unauthorized access.