A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7342 |
Exploitation
To exploit this vulnerability, an attacker must gain access to the build VM during the image creation process. By modifying the image while the build is in progress, the attacker can enable default credentials that allow root access to the resulting VM images, which can then be used to compromise Kubernetes clusters that utilize these images.
Affected Products
- Kubernetes Image Builder: The tool used for creating VM images that may have default credentials enabled during the build process.
- Nutanix OVA Provider: A provider that allows the creation of VM images with potential security issues due to default credentials.
- VMware OVA Provider: Similar to Nutanix, this provider can also lead to vulnerabilities in Kubernetes clusters if default credentials are not managed properly.
Mitigation
To mitigate this vulnerability, it is essential to ensure that default credentials are disabled during the image build process. Users should review their build configurations and apply security best practices to prevent unauthorized access during the image creation phase.