High severity8.2NVD Advisory· Published Mar 17, 2025· Updated Apr 15, 2026

CVE-2025-2241

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/openshift/hiveGo	<= 1.1.16	—

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-c339-mwfc-fmr2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-2241ghsaADVISORY
access.redhat.com/security/cve/CVE-2025-2241nvdWEB
bugzilla.redhat.com/show_bug.cginvdWEB
github.com/openshift/hive/pull/2612nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000