CVE-2025-2241

HIGH8.2EPSS 0.04%

Openshift Hive Exposes VCenter Credentials via ClusterProvision

Published: 3/17/2025Modified: 3/18/2026

Also known as:GHSA-c339-mwfc-fmr2GO-2025-3529

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Affected packages (2)

Go/github.com/openshift/hivefrom 0, <= 1.1.16
Go/github.com/openshift/hivefrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.2	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References (6)

ADVISORYhttps://github.com/advisories/GHSA-c339-mwfc-fmr2
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-2241
PATCHhttps://github.com/openshift/hive
WEBhttps://access.redhat.com/security/cve/CVE-2025-2241
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2351350
WEBhttps://github.com/openshift/hive/pull/2612