An issue in oslabs-beta ThermaKube master contains hard‑coded password credentials, aligning with CWE‑259. This flaw enables an attacker who can discover the default credentials to log in with elevated privileges, potentially gaining full control over the system and compromising confidentiality, integrity, and availability. The vulnerability arises from an insecure design choice that embeds passwords directly in the code base.

The vulnerability affects the ThermaKube master component of the oslabs-beta project. No specific version information is available in the advisory.

The CVSS base score of 9.8 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires accessing the service that uses the hard‑coded credentials, which could be remote or local, depending on deployment. The flaw provides an unprivileged entry point that could lead to full system compromise if an attacker supplies the default password.