CVE-2025-2241: Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Other sources
Using hive (including via MCE or ACM) to provision a VSphere cluster requires supplying VCenter credentials via a Secret in the same namespace as the ClusterDeployment that declares the desired configuration of the cluster. These credentials are echoed back once the cluster is provisioned via the ClusterProvision object that hive creates in the same namespace. It is likely that customers don't realize this, and may have RBAC allowing ClusterProvision read access to users who would otherwise not be trusted with VCenter credentials.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict RBAC read access to ClusterProvision objects (and related Hive/ClusterProvision resources) so only trusted users/service accounts can read them, to prevent extraction of exposed vCenter credentials echoed into ClusterProvision after provisioning.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2241?
CVE-2025-2241 has a high severity due to the exposure of sensitive VCenter credentials.
How do I fix CVE-2025-2241?
To fix CVE-2025-2241, update Red Hat Hive, Multicluster Engine (MCE), and Advanced Cluster Management (ACM) to the latest patched versions.
What systems are affected by CVE-2025-2241?
CVE-2025-2241 affects Red Hat Hive, Multicluster Engine (MCE), and Advanced Cluster Management (ACM) software.
How does CVE-2025-2241 impact security?
CVE-2025-2241 impacts security by potentially allowing unauthorized access to VCenter credentials.
When was CVE-2025-2241 disclosed?
CVE-2025-2241 was disclosed on 2025-03-10.