# CVE-2025-9276

## Summary

- **CVE ID:** CVE-2025-9276
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-258
- **Published:** Sep 2, 2025
- **Last Modified:** Mar 12, 2026

## Description

Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image.

The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.

## Affected Products

- Cockroach Labs — cockroach-k8s-request-cert (cockroachdb/cockroach-k8s-request-cert:latest)

## References

- [CNA](https://www.zerodayinitiative.com/advisories/ZDI-25-855/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.65%
- **EPSS Percentile:** 49.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._