Detections
Analytics

SCA: security update for github.com/kubernetes-sigs/image-builder (GHSA-9224-ggvw-wh7v)

critical Tenable Cloud Security Plugin ID 412946

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default
 credentials are enabled during the image build process. Virtual machine images built using the Proxmox
 provider do not disable these default credentials, and nodes using the resulting images may be accessible
 via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are
 only affected if their nodes use VM images created via the Image Builder project with its Proxmox
 provider. (CVE-2024-9486)

See Also

https://github.com/advisories/GHSA-9224-ggvw-wh7v

Plugin Details

Severity: Critical

ID: 412946

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.07

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-9486

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2024

Vulnerability Publication Date: 10/15/2024

Reference Information

CVE: CVE-2024-9486

cwe: CWE-798