kubernetes Image Builder vulnerabilities

Latest kubernetes Image Builder CVEs

Newest publication first

1. CVE-2025-7342 VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

   Published 2025-08-17

   High·CVSS 7.5 EPSS 0.40%

   A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Ku...

2. CVE-2024-9594 VM images built with Image Builder with some providers use default credentials during builds

   Published 2024-10-15

   High·CVSS 8.1 EPSS 1.7%

   A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabl...

3. CVE-2024-9486 VM images built with Image Builder and Proxmox provider use default credentials

   Published 2024-10-15

   Critical·CVSS 9.8 EPSS 2.2%

   A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resultin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.