A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7342 |
Exploitation
To exploit this vulnerability, an attacker must gain access to the build VM during the image creation process. By modifying the image while it is being built, the attacker can enable default credentials that allow root access to the resulting VM images, which can then be used to compromise Kubernetes clusters that utilize these images.
Affected Products
- Kubernetes Image Builder: The tool used for creating VM images, particularly with Nutanix or VMware OVA providers, is affected due to the default credentials being enabled during the build process.
- Windows VM Images: Any Windows VM images created using the Kubernetes Image Builder with the specified providers may be compromised if the vulnerability is exploited.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that the Kubernetes Image Builder is configured to disable default credentials during the image build process. Additionally, users should monitor their build environments for unauthorized access and consider implementing stricter access controls.