CVE-2024-9594

CVE-2024-9594 is a critical security flaw in Kubernetes Image Builder versions <= v0.1.37, affecting VM images built using Nutanix, OVA, QEMU, or raw providers. During the image build process, default credentials are enabled, allowing an attacker to gain root access to the VM. While these credentials are disabled post-build, an attacker could exploit this vulnerability if they accessed the VM during its creation to modify the image. The vulnerability carries a CVSS score of 8.1 (HIGH), indicating a high severity due to its network-based attack vector, low attack complexity, and potential for complete compromise (confidentiality, integrity, and availability). The FAUCET Risk Score is 65/100, and the CWE is CWE-798 (Use of Hard-coded Credentials). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article, suggesting limited public awareness despite its critical nature.