CVE-2025-9276criticalCWE-258

CVE-2025-9276: falha crítica em cockroach-k8s-request-cert

Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cockroach-k8s-request-cert

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.7%
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Cockroach Labs · cockroach-k8s-request-cert