CVE-2025-2241 Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
Attackers with read access to ClusterProvision objects can extract exposed vCenter credentials, leading to unauthorized access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-2241?
CVE-2025-2241 is a high-severity vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 17 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Weakness: CWE-922
Which versions are affected by CVE-2025-2241?
3 open source packages ship an affected version, including github.com/openshift/hive.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/hive Go | All versions | None |
github.com/openshift/hive Go | All versions to 1.1.16 | None |
github.com/openshift/hive Go | All versions to 1.1.16 | None |
How do I fix CVE-2025-2241?
Apply the vendor's patch.
Is CVE-2025-2241 being exploited?
There is no known exploitation of CVE-2025-2241 in the wild and no public exploit code.
Sources
Also known as GHSA-c339-mwfc-fmr2, GO-2025-3529.