A critical CVE-2025-7342 haunts Kubernetes Image Builder v0.1.44 and earlier. It ships Nutanix/OVA images with default Windows Administrator creds intact. That slip-up invites root access on Windows nodes. Linux builds and other providers dodge this bullet. Mixed clusters run hot until images rebuild or passwords rotate. Jump to v0.1.45+. It demands `WINDOWS_ADMIN_PASSWORD` or `admin_password` in your JSON. Default-credential attack, kaput.