High severity8.2GHSA Advisory· Published Mar 17, 2025· Updated Apr 15, 2026
CVE-2025-2241
CVE-2025-2241
Description
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openshift/hiveGo | <= 1.1.16 | — |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/openshift/hivepkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
<= 1.1.16+ 1 more
- (no CPE)range: <= 1.1.16
- (no CPE)range: < 0.0.20250318T181448-1.1
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.