Security Advisory

CVE-2025-2241

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-03-17 16:27:20

Last updated 2026-03-18 15:30:24

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

← Browse all CVEs View on cve.org ↗