CVE-2024-9486criticalCWE-798

CVE-2024-9486: critical vulnerability in Kubernetes Image Builder

VM images built with Image Builder and Proxmox provider use default credentials

Published · Updated

Follow this CVE+ Monitor Image Builder+ Monitor github.com/kubernetes-sigs/image-builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 9.8epss 2.2%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 25/2024Vulnerabilidade crítica no Kubernetes Image Builderread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Kubernetes · Image Builder
Related CVEs — Kubernetes Image Builder

In the same product, most dangerous first.

CVE-2024-9594MEDIUMVM images built with Image Builder with some providers use default credentials during buildsEPSS 1.7%CVE-2025-7342HIGHVM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not overrideEPSS 0.4%