Cockroach Labs cockroach-k8s-request-cert Empty Root Password Auth Bypass (CVE-2025-9276)

Critical Vulnerability Information Vulnerability Name: Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability Vulnerability IDs: - ZDI-25-855 - ZDI-CAN-22195 - CVE-2025-9276 CVSS Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Vendor: Cockroach Labs Affected Product: cockroach-k8s-request-cert Vulnerability Details: - This vulnerability allows remote attackers to bypass authentication on systems using the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. - The specific issue lies in the configuration of the system's shadow file, where the root user is assigned an empty password. Attackers can exploit this to bypass system authentication. Additional Details: - On October 6, 2023, ZDI made multiple attempts to contact the vendor without receiving a response. - On August 8, 2025, ZDI notified the vendor that it would be publishing this case as a 0-day advisory. - Mitigation: As of August 27, 2025, ZDI confirmed that contact requests submitted through the official vulnerability disclosure channel designated by Cockroach Labs had not been submitted. Therefore, the vendor was unaware of the issue. However, messages sent through other official vendor contact channels over the past two years also received no response. On August 25, 2025, Cockroach Labs received the report and confirmed that the container image is no longer part of the services supported by Cockroach Labs. Both parties remain committed to protecting users. Disclosure Timeline: - March 11, 2025 - Vulnerability reported to vendor - August 27, 2025 - Coordinated public advisory release - August 27, 2025 - Advisory update Contributor: Alfredo de Oliveira - Trend Micro Nebula Team

Goal Reached Thanks to every supporter — we hit 100%!

Cockroach Labs cockroach-k8s-request-cert Empty Root Password Auth Bypass (CVE-2025-9276)