Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-2241

Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

hive

Default version status: unaffected

  • 1.2.4105-7735bf3 to ≤ 1.1.16affected

Red Hat Multicluster Engine for Kubernetes

Default version status: affected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Default version status: affected

References