Summary
Kubernetes Image Builder versions v0.1.44 and earlier enable default credentials on Windows VM images during the build process when using the Nutanix or VMware OVA providers. These default credentials, which allow root (Administrator) access, are intended to be disabled upon completion of the build. However, an attacker who can access the build VM during the active build process could exploit these credentials to modify the resulting image.
Impact
Kubernetes clusters are only at risk if their nodes use Windows VM images produced by Image Builder with the Nutanix or OVA provider, and only if an attacker was able to access the build VM during the image build process. Exploitation requires network access to the build VM during the build window and interaction from the user running the build. An attacker who successfully modifies the image during this window can achieve persistent, root-level access to any cluster node booted from the tampered image, leading to full node compromise and potential cluster-wide impact.
Detection
On affected Windows nodes, check whether the Administrator account remains enabled and review its last logon time:
Get-LocalUser -Name Administrator | Select-Object Name,Enabled,SID,Lastlogon | Format-List
If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io. Additionally, verify the Image Builder version used to produce your node images using one of the following methods:
- For git clones:
cd <image-builder-repo> && make version - For tarball installs:
grep -o 'v0\.[0-9.]*' RELEASE.md | head -1 - For container image releases:
docker run --rm <image-pull-spec> version
Mitigation
Upgrade Kubernetes Image Builder to v0.1.45 or later and rebuild any affected Windows VM images. Redeploy nodes using the rebuilt images.
Prior to upgrading, set a strong password for the Administrator account on any affected VMs:
net user Administrator <new-password>
Alternatively, use Image Builder v0.1.41 or later and explicitly set the admin_password JSON variable or the WINDOWS_ADMIN_PASSWORD environment variable when running builds. Starting with v0.1.45, omitting both variables causes the build to fail rather than use a default credential.