CVE-2025-6017: Rhacm: users with clusterreader role can see credentials from managed-clusters
A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.
Other sources
Users having the 'ClusterReader' role in RHACM can see the credentials from Managed-clusters created by ACM via the UI.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Advanced Cluster Management (RHACM)to a version that resolves this vulnerability.Fixed in 2.10.7 - Upgrade
Upgrade
Red Hat Advanced Cluster Management (RHACM)to a version that resolves this vulnerability.Fixed in 2.11.4 - Upgrade
Upgrade
Red Hat Advanced Cluster Management (RHACM)to a version that resolves this vulnerability.Fixed in 2.12.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6017?
CVE-2025-6017 is a medium severity vulnerability that allows unprivileged users to access confidential managed cluster credentials.
How do I fix CVE-2025-6017?
To fix CVE-2025-6017, upgrade Red Hat Advanced Cluster Management to version 2.10.7 or later, 2.11.4 or later, or 2.12.4 or later.
Who is affected by CVE-2025-6017?
CVE-2025-6017 affects Red Hat Advanced Cluster Management versions 2.10 before 2.10.7, 2.11 before 2.11.4, and 2.12 before 2.12.4.
What kind of information is exposed by CVE-2025-6017?
CVE-2025-6017 exposes confidential managed cluster credentials through the user interface.
Is CVE-2025-6017 a user privilege issue?
Yes, CVE-2025-6017 allows unprivileged users to access sensitive information that should be restricted.