CVE-2025-7342
HIGH EPSS 25.4%
Published Aug 17, 202510mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
Published Aug 17, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago
Description
A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
25.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-798 Use of Hard-coded Credentials Authentication
References 3
- openwall.com http://www.openwall.com/lists/oss-security/2025/07/22/1
- github.com https://github.com/kubernetes/kubernetes/issues/133115
- groups.google.com https://groups.google.com/g/kubernetes-security-announce/c/tuEsLUQu_PA
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.