Read the docs
TI-2025-06694 Aliases CVE-2025-7342GHSA-4cww-rww7-fw7q

Hard-coded credentials in Kubernetes Image Builder

Priority LOW 35CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00399 34th percentileScored 2026-11-07
Fix Fixed Image Builder (Kubernetes): 0.1.45

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesImage Builderup to 0.1.440.1.45Patch availableCNA
  • Image Builder VendorKubernetes Affected up to 0.1.44 Fixed in 0.1.45 Patch available CNA

Remediation

  • Fix · CNA Image Builder (Kubernetes) Fixed in 0.1.45

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7342
  2. 2026-10-03 Alias added: GHSA-4cww-rww7-fw7q

References

Other 2

  • TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
  • TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences