Dashboard / CVE-2025-2241

CVE-2025-2241

HIGH
MEDIUM Priority: 0.04 BB Relevance: 56/100
Published: 2025-03-17 Modified: 2026-10-31 First seen: 2026-10-31 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Changed
C: High
I: High
A: None

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
— — 1.2.4105-7735bf3

References & Advisories (3)

https://bugzilla.redhat.com/show_bug.cgi?id=2351350
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

56 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

8.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS — Exploitation Probability

0.50%
Raw Score 0.004970
Percentile 42.7%
Date 2026-11-03

EPSS Trend

2026-11-03
0.00497
2026-11-02
0.00497
2026-11-01
0.00497
2026-10-31
0.00497
2026-10-30
0.00497

Intelligence Sources

mitre ref →
nvd ref →

External Links