Kubernetes Image Builder Nutanix and OVA Default Credentials Vulnerability on Windows VMs

A vulnerability exists in Kubernetes Image Builder versions through v0.1.44, specifically when using the Nutanix or OVA provider, where default credentials are not disabled for Windows virtual machine images. This oversight can lead to unauthorized access via SSH, RDP, or WINRM, allowing root access to the affected nodes. Clusters are only vulnerable if their Windows nodes utilize these default credential images from the specified providers.

Impact

Exploitation of this vulnerability allows unauthorized users to access Windows nodes via default credentials, potentially leading to root access.

Remediation

To address this vulnerability, rebuild any affected images using Kubernetes Image Builder version v0.1.45 or later. After rebuilding, redeploy the updated images to any affected virtual machines. If an immediate upgrade is not possible, change the password of the Administrator account on affected VMs as a temporary measure.