CVE-2024-9594: Kubernetes Image Builder Privilege Escalation

CVE-2024-9594 Overview

CVE-2024-9594 is a high-severity vulnerability in the Kubernetes Image Builder project affecting versions <= v0.1.37. The flaw exists when building virtual machine (VM) images using the Nutanix, OVA, QEMU, or raw providers. During the build process, default credentials are enabled on the image, allowing root access to any attacker who can reach the build host. The credentials are removed at the end of the build, so only nodes whose images were tampered with during build are affected. The issue is tracked under CWE-798: Use of Hard-coded Credentials.

Critical Impact
An attacker with network access to the VM during image build can authenticate using default credentials and gain root access to the resulting Kubernetes node image.

Affected Products

Kubernetes-sigs Image Builder <= v0.1.37
VM images produced via the Nutanix, OVA, QEMU, or raw providers
Kubernetes clusters using nodes built from affected images

Discovery Timeline

2024-10-15 - CVE-2024-9594 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9594

Vulnerability Analysis

The Kubernetes Image Builder automates the creation of machine images for Kubernetes nodes across multiple infrastructure providers. During image construction, the build tooling provisions a temporary VM and configures it with a default account to allow Packer and Ansible automation to log in and customize the system. With the Nutanix, OVA, QEMU, and raw providers, this default credential is active throughout the build window. An attacker with network reachability to the builder VM during this period can authenticate over SSH and execute commands as root. The credentials are cleared before the final image is sealed, so completed images do not retain the default account. The exposure is therefore limited to the build phase itself.

Root Cause

The root cause is the use of hard-coded default credentials [CWE-798] embedded in the image build automation. The affected providers did not enforce build-time network isolation or randomize the bootstrap password. Any process that could connect to the build VM during provisioning could authenticate without further attack complexity.

Attack Vector

Exploitation requires network access to the transient build VM while the Image Builder pipeline is running. An attacker who reaches the SSH service can log in with the default account, escalate to root, and modify the image contents before it is finalized. Modifications, such as implanted binaries, backdoored kubelet configuration, or malicious systemd units, persist into every node provisioned from that image. The high attack complexity reflects the narrow time window and the requirement to be on a network path to the build host. See the Kubernetes Security Announcement for the upstream advisory.

Detection Methods for CVE-2024-9594

Indicators of Compromise

SSH authentication events on Image Builder VMs originating from IP addresses outside the expected CI/CD subnet
Unexpected sudo, package installation, or file modification activity on transient build hosts during image creation
Unauthorized changes to base image artifacts (/etc/systemd/system/, kubelet binaries, container runtime configs) after build completion
Node images produced by Image Builder versions <= v0.1.37 deployed into production clusters

Detection Strategies

Compare hashes of produced VM images against expected baselines generated in an isolated reference environment
Audit Packer and Ansible build logs for authentication events not initiated by the build orchestrator
Inventory Kubernetes nodes and correlate the image-builder version used to construct their OS images
Run host-based integrity checks on running nodes to identify drift from the documented image manifest

Monitoring Recommendations

Forward SSH and authentication logs from Image Builder hosts to a centralized SIEM for review
Alert on any inbound network traffic to the build VM from sources outside the approved build network
Track Image Builder repository versions used by CI pipelines and flag use of releases <= v0.1.37
Monitor Kubernetes audit logs for anomalous workload behavior shortly after rolling out new node images

How to Mitigate CVE-2024-9594

Immediate Actions Required

Upgrade Kubernetes Image Builder to a version later than v0.1.37 before running any new image builds
Rebuild and redeploy any node images previously produced with the Nutanix, OVA, QEMU, or raw providers using a patched Image Builder
Restrict network access to build VMs so that only the build orchestrator can reach them during provisioning
Review the fix in the upstream GitHub Pull Request #1596 and align internal pipelines with the corrected behavior

Patch Information

The Kubernetes-sigs project addressed the issue in Image Builder releases after v0.1.37. The remediation replaces the static default credentials with randomized, build-scoped values and tightens cleanup at the end of the build. Tracking and discussion are available in the Kubernetes Issue Tracker and the GitHub Pull Request.

Workarounds

Execute image builds only on isolated networks with no inbound connectivity from untrusted hosts
Use ephemeral, single-tenant build infrastructure that is destroyed immediately after each build
Manually override the default credentials in build templates with strong, randomized values until upgrading is possible
Validate produced images with integrity checks before publishing them to internal image registries

bash

# Verify the installed Image Builder version before running a build
git -C image-builder describe --tags

# Example: pin builds to a fixed, patched tag in CI
IMAGE_BUILDER_REF="v0.1.38"  # or newer
git -C image-builder fetch --tags
git -C image-builder checkout "${IMAGE_BUILDER_REF}"