CVE-2025-9276

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image.

The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-258

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-92776.4The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all CVE-2025-92787.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the CVE-2025-92797.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP CVE-2025-92807.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the CVE-2025-92817.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensi CVE-2025-92827.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensi CVE-2025-92837.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP CVE-2025-92869.8The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rese CVE-2025-92879.1Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.CVE-2025-92889.1Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.CVE-2025-92894.7A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitati CVE-2025-92905.9An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handl