CVE-2025-2241CWE-922

CVE-2025-2241

High · published March 17, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-922 · Insecure Storage of Sensitive Information
Published
2025-03-17T21:15Z
References (3)
https://access.redhat.com/security/cve/CVE-2025-2241 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2351350 · [email protected]https://github.com/openshift/hive/pull/2612 · [email protected]
EPSS history
Timeline
  • 17 MAR 16:27Z
    Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
    cvelistv5