Authentication Bypass via Empty Root Password in Cockroach Labs cockroach-k8s-request-cert

Successful exploitation allows an attacker to bypass authentication and obtain unauthorized root-level access within the affected container environment. Because the compromised account is root, the attacker can fully control the container, access sensitive material handled by the image such as certificate-related assets, alter configuration, execute arbitrary commands, and potentially use the container as a pivot point within the Kubernetes environment depending on mounted secrets, service account permissions, network reachability, and runtime configuration.

If immediate replacement is not possible, reduce exposure by preventing any remote or interactive authentication path into the container, restricting network access to the workload, disabling or avoiding services that rely on PAM or system password authentication, and enforcing least-privilege container runtime settings. Review deployed container configurations, monitor authentication logs for anomalous root logins, perform integrity checks on /etc/shadow, scan container images for empty-password conditions, and use SIEM detections for unexpected root access. Limiting container privileges, mounted secrets, and Kubernetes RBAC permissions can also reduce post-compromise impact.

The provided content indicates the affected cockroach-k8s-request-cert image is no longer supported by Cockroach Labs and does not identify a vendor patch. Remediation therefore requires user-side replacement or rebuilding of the image so that the root account is not configured with an empty password in /etc/shadow. Organizations should stop using the vulnerable image where possible, replace it with a maintained alternative for certificate management, and validate that any derived or mirrored images have a locked or properly hashed root password entry. After replacement, redeploy affected workloads and verify that no authentication path permits passwordless root access.