Critical severity · published Oct 15, 2024
CVE-2024-9486
VM images built with Image Builder and Proxmox provider use default credentials
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Image Builder · Kubernetes
through 0.1.37 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9486
Patch
https://github.com/kubernetes-sigs/image-builder/pull/1595
Issue Tracking
https://github.com/kubernetes/kubernetes/issues/128006
Vendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
More from Image Builder
8.1
CVE-2024-9594
VM images built with Image Builder with some providers use default credentials during builds
7.5
CVE-2025-7342
VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override