A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Virtual machine images built using the Nutanix or the OVA provider do not disable these default credentials, potentially allowing unauthorized access. Kubernetes clusters are affected if their Windows nodes use VM images created via the Image Builder project with its Nutanix or OVA provider.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7342 |
Exploitation
To exploit this vulnerability, an attacker would need to access a Kubernetes cluster that uses VM images created with the Image Builder project. By leveraging the default credentials that are enabled during the image build process, the attacker could gain root access to the nodes running these images.
Affected Products
- Kubernetes Image Builder: The tool used to create VM images for Kubernetes clusters.
- Nutanix Provider: A specific provider for building images that does not disable default credentials.
- OVA Provider: Another provider that fails to disable default credentials in built images.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that any VM images created using the Kubernetes Image Builder do not have default credentials enabled. Users should review their image build processes and apply necessary configurations to secure their Kubernetes clusters.