CVE-2025-2241: Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
First published: Tue Mar 11 2025(Updated: )
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Hive | ||
| Red Hat Multicluster Engine | ||
| Red Hat Advanced Cluster Management | ||
| go/github.com/openshift/hive | <=1.1.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2241?
CVE-2025-2241 has a high severity due to the exposure of sensitive VCenter credentials.
How do I fix CVE-2025-2241?
To fix CVE-2025-2241, update Red Hat Hive, Multicluster Engine (MCE), and Advanced Cluster Management (ACM) to the latest patched versions.
What systems are affected by CVE-2025-2241?
CVE-2025-2241 affects Red Hat Hive, Multicluster Engine (MCE), and Advanced Cluster Management (ACM) software.
How does CVE-2025-2241 impact security?
CVE-2025-2241 impacts security by potentially allowing unauthorized access to VCenter credentials.
When was CVE-2025-2241 disclosed?
CVE-2025-2241 was disclosed on 2025-03-10.
- agent/title
- agent/weakness
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-2241
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c339-mwfc-fmr2
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/source
- agent/event
- collector/nvd-cve
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/red hat
- canonical/red hat hive
- canonical/red hat multicluster engine
- canonical/red hat advanced cluster management
- package-manager/go