GitHub Advisoryadvisory · Go

GHSA-c339-mwfc-fmr2 Openshift Hive Exposes VCenter Credentials via ClusterProvision

HIGH Published 2025-03-17 Modified 2026-03-18 Official page ↗
Aliases
CVE-2025-2241
Ecosystem
Go
Packages
github.com/openshift/hive
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-922
Reviewed
2025-03-17

Affected packages

• Go github.com/openshift/hive: <= 1.1.16 (no fix yet)

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Related

Alias · CVE (1)

  • CVE-2025-2241 A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). vulnerability

Weakness · CWE (1)

  • CWE-922 Insecure Storage of Sensitive Information weakness

References