Kubernetes CVE-2025-2241

The CVSS score of 8.2 reflects high severity due to high confidentiality and integrity impacts with changed scope, though the attack complexity is high and requires low-level privileges. The network attack vector (AV:N) indicates remote exploitability, but the high complexity (AC:H) suggests specific conditions must be met. The EPSS score of 0.13% at the 32nd percentile indicates relatively low predicted exploitation probability in the wild. Real-world risk is moderate: while the technical impact is severe (full VCenter credential compromise leading to infrastructure control), exploitation requires authenticated access to the Kubernetes cluster with ClusterProvision read permissions. The availability of a patch (GitHub PR #2612) reduces ongoing risk for organizations that apply updates promptly. This is a genuine priority for organizations running ACM/MCE with VMware vSphere integrations, but not an imminent threat requiring emergency response for most environments.

An attacker with authenticated access to the Kubernetes cluster and RBAC permissions to read ClusterProvision custom resources queries these objects after a vSphere cluster provisioning operation completes. The attacker extracts exposed VCenter credentials from the ClusterProvision object metadata or status fields and uses them to authenticate directly to the VMware vCenter environment. With VCenter access, the attacker can manage virtual machines, access other workloads in the infrastructure, escalate privileges within the virtualization layer, or pivot to compromise additional clusters and resources managed through the same VCenter instance.