Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-7342

VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Image Builder

Default version status: unaffected

  • 0 to ≤ 0.1.44affected
  • 0.1.45unaffected

References