CVE-2024-9486: kubernetes-sigs image_builder Use of Hard-coded Credentials
Vulnerability summary
CVE-2024-9486 is a critical (CVSS 9.8) Use of Hard-coded Credentials vulnerability in kubernetes-sigs image_builder. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 15-10-2024PublishedVulnerability first disclosed.
- 16-10-2024Last modifiedVulnerability information updated.
Description
A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Github.com/kubernetes-sigs1 product
- image-builder< 0.1.38
Kubernetes1 product
- image builder≤ 0.1.37
Kubernetes-sigs1 product
- image_builder< 0.1.38
3 vendors · 3 products
References
5 links- groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJMailing ListWEBVendor Advisory
