Kubernetes Image Builder has been found to have critical vulnerabilities that could allow attackers to gain unauthorized root access to virtual machines (VMs) using default credentials. The first flaw, tracked as CVE-2024-9486, is rated as critical with a CVSS score of 9.8/10, and specifically impacts VMs built with the Proxmox provider, where default credentials remain enabled after the build process. This vulnerability allows attackers to connect via SSH and gain root access to the affected VMs. The issue is fixed in Kubernetes Image Builder version 0.1.38, which introduces a random password during the build process and disables the “builder” account after completion. The second vulnerability, tracked as CVE-2024-9594 (CVSS score: 6.3), affects VM images built with providers like Nutanix, OVA, and QEMU, however, exploitation is harder because attackers need access to the image-building VM during the process. To mitigate these risks, users are urged to upgrade to version 0.1.38, rebuild vulnerable images, and redeploy them. Temporary mitigation includes disabling the “builder” account on affected VMs. Addressing these vulnerabilities is crucial for ensuring the security of Kubernetes clusters, and CTIX analysts urge users to upgrade to the latest patch immediately.