Hard-Coded Credentials Vulnerability In Kubernetes Image Builder

A critical vulnerability has been addressed with the latest release of Kubernetes Image Builder. This vulnerability was related to hard-coded credentials that could potentially allow unauthorized access to malicious actors.

Kubernetes Image Builder Vulnerability

According to the latest advisory, two security issues have been patched in the latest Kubernetes Image Builder release.

One of these issues, identified as CVE-2024-9486, was caused by hard-coded credentials that were active during the image-building process. These credentials could be exploited to gain root access to nodes using the images, particularly when built with the Proxmox provider.

This vulnerability affected Kubernetes Image Builder versions v0.1.37 and earlier when built with the Proxmox provider. More details about this vulnerability can be found on GitHub.

To address the vulnerability, Kubernetes recommends rebuilding images using the patched Image Builder versions and deploying them to the virtual machines.

This critical vulnerability received a CVSS score of 9.8 and was initially discovered by security researcher Nicolai Rybnikar from Rybnikar Enterprises GmbH. The issue was promptly addressed by the project team, and a fix was released with Kubernetes Image Builder v0.1.38. Marcus Noble from the Image Builder project was acknowledged for patching the issue.

Furthermore, the same Image Builder release also fixed another security flaw, identified as CVE-2024-9594. This medium-severity vulnerability (CVSS 6.3) is similar to the previous issue but affects images built with Nutanix, OVA, QEMU, or raw providers. Details about this vulnerability can be found on GitHub.

Users are advised to update to Kubernetes Image Builder version 0.1.38 or later to ensure they receive all the necessary patches and avoid potential risks. If an immediate update is not possible, users can disable the builder account on affected virtual machines using the command: usermod -L builder.

Share your thoughts in the comments section below.