Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-2241

Date: March 17, 2025

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Severity Score

Related Resources (6)

https://github.com/openshift/hive
https://nvd.nist.gov/vuln/detail/CVE-2025-2241
https://bugzilla.redhat.com/show_bug.cgi?id=2351350
https://github.com/advisories/GHSA-c339-mwfc-fmr2
https://access.redhat.com/security/cve/CVE-2025-2241
https://www.mend.io/vulnerability-database/CVE-2025-2241

Severity Score

Weakness Type (CWE)

Insecure Storage of Sensitive Information

CWE-922

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us