What is the CVSS score of CVE-2025-2241?

CVE-2025-2241 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Kubernetes are affected by CVE-2025-2241?

A credential exposure flaw in Red Hat's Multicluster Engine and Advanced Cluster Management could allow internal users with basic read permissions to extract VCenter credentials, potentially…. A patch is available.

How to fix or mitigate CVE-2025-2241?

Within 24 hours: Identify and inventory all ClusterProvision objects in ACM/MCE environments and audit who has read access to them. Within 7 days: Implement network segmentation to restrict ClusterProvision object access to only necessary service accounts and disable VSphere provisioning if not actively required. Within 30 days: Apply vendor patch when released, rotate all VCenter credentials, and review access logs for suspicious ClusterProvision queries.

Kubernetes CVE-2025-2241

HIGH

Insecure Storage of Sensitive Information (CWE-922)

2025-03-17 secalert@redhat.com

GHSA-c339-mwfc-fmr2

Red Hat Kubernetes Information Disclosure Privilege Escalation Suse

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 18, 2026 - 16:22 vuln.today

CVE Published

Mar 17, 2025 - 17:15 nvd

HIGH 8.2

DescriptionCVE.org

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

AnalysisAI

A credential exposure vulnerability in Red Hat Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM), allows VCenter credentials to leak into ClusterProvision objects after VSphere cluster provisioning. Users with read access to ClusterProvision objects can extract these credentials without needing direct Kubernetes Secret access, enabling unauthorized VCenter access, cluster manipulation, and privilege escalation. With an EPSS score of 0.13% (32nd percentile), active exploitation is currently assessed as low probability, and no public exploits have been reported.

Technical ContextAI

This vulnerability affects Red Hat Hive, an operator for provisioning and managing OpenShift clusters in hybrid cloud environments, specifically within Multicluster Engine and Advanced Cluster Management products. The root cause falls under CWE-922 (Insecure Storage of Sensitive Information), where VCenter authentication credentials are improperly stored in ClusterProvision custom resource objects after VMware vSphere cluster provisioning operations. This violates Kubernetes security best practices by exposing sensitive data outside the intended Secret storage mechanism, allowing users with RBAC permissions to read ClusterProvision objects to access credentials they should not have visibility into.

Affected ProductsAI

Red Hat Advanced Cluster Management (ACM) and Red Hat Multicluster Engine (MCE) are affected through their embedded Hive component used for VSphere cluster provisioning. The vulnerability impacts deployments that provision VMware vSphere clusters through Hive's ClusterProvision workflow. Specific version information is available in Red Hat Bugzilla 2351350 at https://bugzilla.redhat.com/show_bug.cgi?id=2351350 and the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2025-2241. Organizations using Hive for vSphere cluster management in OpenShift environments should verify their deployment status.

RemediationAI

Apply the patch available in GitHub pull request #2612 at https://github.com/openshift/hive/pull/2612, which addresses the credential exposure issue in Hive's ClusterProvision objects. Red Hat customers should monitor the official security advisory at https://access.redhat.com/security/cve/CVE-2025-2241 for updated packages and follow Red Hat's update procedures for ACM and MCE components. As an interim mitigation, restrict RBAC permissions to ClusterProvision objects to only essential users and service accounts, audit existing access logs for unauthorized ClusterProvision reads, and rotate VCenter credentials for environments where unauthorized access may have occurred. Consider implementing additional monitoring for ClusterProvision object access patterns to detect potential credential harvesting attempts.