CVE-2025-2241
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
CVE-2025-2241- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
EUVDEUVD-2025-6523
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
EUVD-2025-6523- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c339-mwfc-fmr2
Openshift Hive Exposes VCenter Credentials via ClusterProvision
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
GHSA-c339-mwfc-fmr2- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
NVD
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
CVE-2025-2241- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSV
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
CVE-2025-2241- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSVGHSA-c339-mwfc-fmr2
Openshift Hive Exposes VCenter Credentials via ClusterProvision
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
- Record
GHSA-c339-mwfc-fmr2- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSVGO-2025-3529 No score
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
- Record
GO-2025-3529- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14910-1 No score
govulncheck-vulndb-0.0.20250318T181448-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250318T181448-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14910-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/openshift/hiveGo |
through 1.1.16 | None known |
github.com/openshift/hiveGo |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 0.0.20250318T181448-1.1 | 0.0.20250318T181448-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2241 is a high vulnerability (CVSS 8.2) in Red Hat Multicluster Engine For Kubernetes, published March 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. No source names a fixed version.