Critical · published October 15, 2024
🚨 Default credentials left wide open in Kubernetes Image Builder v0.1.37! If you’ve built virtual machine images using the Proxmox provider, your nodes are at risk of unauthorized root access! 🔥 Think of it like leaving the front door of your house wide open with a sign that reads 'Free Access, No ID Required!' Anyone can just walk in without breaking a sweat, turning your cozy home into a playground for intruders. An attacker could easily stroll into your Kubernetes cluster and gain root access, allowing them to manipulate resources, steal sensitive data, or even launch further attacks. This could lead to devastating consequences for your entire infrastructure and compromise your organization's security.
Think of it like leaving the front door of your house wide open with a sign that reads 'Free Access, No ID Required!' Anyone can just walk in without breaking a sweat, turning your cozy home into a playground for intruders. This vulnerability stems from the fact that the Kubernetes Image Builder does not disable default credentials when creating VM images with the Proxmox provider. As a result, these credentials remain active, opening the door for attackers to access nodes built from vulnerable images.
An attacker could easily stroll into your Kubernetes cluster and gain root access, allowing them to manipulate resources, steal sensitive data, or even launch further attacks. This could lead to devastating consequences for your entire infrastructure and compromise your organization's security. Immediately audit your Kubernetes nodes to check for images created with the vulnerable Image Builder version. If any are found, patch your Image Builder to version 0.1.38 or later, and ensure default credentials are properly disabled during the image build process. 🛡️ You can tackle this vulnerability head-on! Follow these steps, and you'll lock down your Kubernetes environment in no time. You've got this! 💪