Vulnerability details

CVE-2025-7342

Kubernetes Image Builder

VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

CVSS 3.1

7.5High

Official description

A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (kubernetes)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Kubernetes	Image Builder	v ≤ 0.1.44	CVEProject cvelistV5 (CNA)

References and advisories

https://groups.google.com/g/kubernetes-security-announce/c/tuEsLUQu_PA mailing-list
https://github.com/kubernetes/kubernetes/issues/133115 issue-tracking
http://www.openwall.com/lists/oss-security/2025/07/22/1

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-08-18
Last updated: 2025-11-05
State: Published
Assigner (CNA): kubernetes

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

34.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-798
Use of Hard-coded Credentials