CVE-2024-9486

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Use of Hard-coded Credentials pada kubernetes-sigs image builder. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Rincian

Terbit di NVD

15 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ advisory vendor
• https://github.com/kubernetes-sigs/image-builder/pull/1595 patch
• https://github.com/kubernetes/kubernetes/issues/128006 issue tracking