GHSA-c339-mwfc-fmr2

Openshift Hive Exposes VCenter Credentials via ClusterProvision

Source: GitHub Advisory Database (reviewed) High CVE-2025-2241

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/openshift/hive	<= 1.1.16	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-2241 advisory
https://github.com/openshift/hive/pull/2612 web
https://access.redhat.com/security/cve/CVE-2025-2241 web
https://bugzilla.redhat.com/show_bug.cgi?id=2351350 web
https://github.com/openshift/hive package