CVE-2024-9594: kubernetes-sigs image_builder Use of Hard-coded Credentials
Vulnerability summary
CVE-2024-9594 is a high (CVSS 8.1) Use of Hard-coded Credentials vulnerability in kubernetes-sigs image_builder. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 15-10-2024PublishedVulnerability first disclosed.
- 16-10-2024Last modifiedVulnerability information updated.
Description
A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA6.3MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
+0.10 pp
From 1.63% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Github.com/kubernetes-sigs1 product
- image-builder< 0.1.38
Kubernetes1 product
- image builder≤ 0.1.37
Kubernetes-sigs1 product
- image_builder< 0.1.38
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
4 vendors · 4 products
References
6 links- groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJMailing ListREPORTWEBVendor Advisory
