CVE-2025-2241
HIGH
GHSA-c339-mwfc-fmr2
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3Description
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Analysis
A credential exposure vulnerability in Red Hat Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM), allows VCenter credentials to leak into ClusterProvision objects after VSphere cluster provisioning. Users with read access to ClusterProvision objects can extract these credentials without needing direct Kubernetes Secret access, enabling unauthorized VCenter access, cluster manipulation, and privilege escalation. With an EPSS score of 0.13% (32nd percentile), active exploitation is currently assessed as low probability, and no public exploits have been reported.
Technical Context
This vulnerability affects Red Hat Hive, an operator for provisioning and managing OpenShift clusters in hybrid cloud environments, specifically within Multicluster Engine and Advanced Cluster Management products. The root cause falls under CWE-922 (Insecure Storage of Sensitive Information), where VCenter authentication credentials are improperly stored in ClusterProvision custom resource objects after VMware vSphere cluster provisioning operations. This violates Kubernetes security best practices by exposing sensitive data outside the intended Secret storage mechanism, allowing users with RBAC permissions to read ClusterProvision objects to access credentials they should not have visibility into.
Affected Products
Red Hat Advanced Cluster Management (ACM) and Red Hat Multicluster Engine (MCE) are affected through their embedded Hive component used for VSphere cluster provisioning. The vulnerability impacts deployments that provision VMware vSphere clusters through Hive's ClusterProvision workflow. Specific version information is available in Red Hat Bugzilla 2351350 at https://bugzilla.redhat.com/show_bug.cgi?id=2351350 and the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2025-2241. Organizations using Hive for vSphere cluster management in OpenShift environments should verify their deployment status.
Remediation
Apply the patch available in GitHub pull request #2612 at https://github.com/openshift/hive/pull/2612, which addresses the credential exposure issue in Hive's ClusterProvision objects. Red Hat customers should monitor the official security advisory at https://access.redhat.com/security/cve/CVE-2025-2241 for updated packages and follow Red Hat's update procedures for ACM and MCE components. As an interim mitigation, restrict RBAC permissions to ClusterProvision objects to only essential users and service accounts, audit existing access logs for unauthorized ClusterProvision reads, and rotate VCenter credentials for environments where unauthorized access may have occurred. Consider implementing additional monitoring for ClusterProvision object access patterns to detect potential credential harvesting attempts.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today