Introduction
An attacker with root access to a Windows node in a Kubernetes cluster can compromise the whole cluster, exfiltrate data, and move laterally. A recent vulnerability in Kubernetes Image Builder, tracked as CVE-2025-7342, creates that risk for any organization that uses the Nutanix or OVA providers to build Windows VM images without overriding the default credentials.
Kubernetes is the dominant open-source container orchestration platform, and enterprises worldwide run cloud-native infrastructure on it. Image Builder is the project's automation tool for creating consistent VM images across providers, so its security directly affects the integrity of production Kubernetes clusters.
Technical information
CVE-2025-7342 comes from Image Builder not enforcing secure credential handling when it builds Windows VM images with the Nutanix or OVA providers. In all versions up to v0.1.44, if the user does not explicitly set the Windows Administrator password (via the WINDOWS_ADMIN_PASSWORD environment variable or admin_password JSON parameter), the build process leaves the default credentials active in the resulting image. That gives attackers a predictable, easily exploited way to authenticate.
The root cause is that image creation neither randomizes the credentials nor requires the user to supply them. An attacker who obtains access to a Windows node built from a vulnerable image can log in with the known default credentials and get full administrative privileges, which allows remote code execution, privilege escalation, and persistence.
The attack surface includes any remote access protocol enabled on the Windows node, such as RDP or WinRM. SSH is another entry point if it is enabled. The risk is highest where these nodes are exposed to untrusted networks or where network segmentation is weak.
This issue is classified under CWE-798 (Use of Hard-coded Credentials). The flaw is architectural, and it sits in the credential management logic of the affected Image Builder versions.
Patch information
Image Builder versions up to v0.1.37 had related vulnerabilities involving default credentials in the image build process, and the development team shipped critical patches for them in later releases.
Proxmox provider default credentials (CVE-2024-9486)
The Proxmox provider used to leave default credentials in the final virtual machine images, which was a significant security risk. The patch in version v0.1.38 removes the 'builder' user account when the image build finishes, so no residual default credentials remain to give an attacker unauthorized access.
Randomized SSH passwords (CVE-2024-9594)
Images built with the Nutanix, OVA, QEMU, or raw providers had default SSH passwords set during the build, and an attacker who gained access during that phase could exploit them. The patch generates a random SSH password for the 'builder' user during the auto-installation process, which significantly reduces the risk of unauthorized access during the build.
Code implementation
# Generate a random password BUILDER_PASSWORD=$(openssl rand -base64 32) # Set the password for the 'builder' user echo "builder:$BUILDER_PASSWORD" | chpasswd # Lock the 'builder' user account after the build process usermod -L builder
Users are strongly encouraged to upgrade to version v0.1.38 or later to get these fixes.
Patch sources:
- https://github.com/kubernetes/kubernetes/issues/133115
- https://github.com/kubernetes-sigs/image-builder/releases/tag/v0.1.45
Detection methods
Finding default credentials in VM images built with Image Builder's Nutanix or OVA providers takes deliberate checking, because the images may carry them unintentionally whenever the build did not override them.
- Review the build configurations used to create each image. Confirm that the credential parameters were set explicitly and not left at default values. This catches any build where default credentials slipped in by oversight.
- Inspect image contents with tools that scan the filesystem and configuration files inside a VM image for default or hard-coded credentials, and address any you find.
- Add automated scanning tools to your CI/CD pipeline so that builds with unset or default credentials get flagged and fixed before deployment.
- After deployment, monitor system and application logs for signs of unauthorized access or anomalies that could point to exploited default credentials. Alerts on unusual login attempts or access patterns help catch incidents early.
- Update and patch all VM images regularly. Staying current with security updates reduces the risk of exploitation through known issues.
Detection source:
Affected systems and versions
- Kubernetes Image Builder versions up to and including v0.1.44 are affected when building Windows VM images with the Nutanix or OVA providers.
- Every Windows VM image created with these providers and versions is vulnerable if the credentials were not explicitly overridden during the build.
- Images where the administrator password was set manually during the build are not affected.
Vendor security history
- Kubernetes Image Builder has had similar vulnerabilities before, including CVE-2024-9486 (Proxmox provider) and CVE-2024-9594 (Nutanix, OVA, QEMU, raw providers).
- The Kubernetes community patched these issues promptly and handled them through coordinated disclosure.
