The Kubernetes project patched a critical vulnerability, tracked as CVE-2024-9486 (CVSS 9.8), in its official Image Builder component used to generate node images for Cluster API (CAPI) deployments. During automated virtual machine provisioning orchestrated via Packer and Ansible, a local administrative account named builder is created with static default credentials to execute system configuration tasks. In builds utilizing the Proxmox provider in versions v0.1.37 and earlier, the cleanup phase failed to purge or lock this user, leaving default credentials permanently active in published VM templates.

Any Kubernetes node provisioned from an affected Proxmox image exposes an interactive SSH service with the static builder account, allowing remote adversaries to gain root access via unrestricted sudo privileges and completely bypass cluster RBAC and container sandboxes. Discovered by researcher Nicolai Rybnikar alongside a secondary build-interception flaw (CVE-2024-9594), the vulnerability was resolved in Kubernetes Image Builder v0.1.38 by implementing ephemeral random passwords and mandatory account deactivation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Static administrative credentials baked directly into base virtualization templates bypass all software-defined perimeter, zero-trust network access, and Kubernetes API admission controls, granting immediate host-level root control beneath containerized workloads.
• Bullet 2 — Strategic & Defender Imperative: Infrastructure teams must immediately audit deployed cluster nodes for the builder account, lock active accounts via usermod -L builder, rebuild all Proxmox VM images using Image Builder v0.1.38 or later, and rotate underlying node SSH keys.