Advisory Details

This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image.

The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system.

10/06/2023 – ZDI attempted to contact the vendor multiple times, but no response was received
08/08/2025 – ZDI notified the vendor of  the intention to  publish the case as  a 0-day advisory

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product.

• 2025-03-11 - Vulnerability reported to vendor
• 2025-08-20 - Coordinated public release of advisory
• 2025-08-20 - Advisory Updated