CVE-2025-2241
Published: 17 March 2025
Summary
CVE-2025-2241 is a high-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 12.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the software flaw in Hive that exposes vCenter credentials in ClusterProvision objects after vSphere cluster provisioning.
Enforces least privilege by restricting read access to sensitive ClusterProvision objects, limiting who can extract exposed vCenter credentials.
Requires management procedures to protect authenticator content like vCenter credentials from unauthorized disclosure in system resources such as ClusterProvision objects.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability exposes vCenter credentials insecurely in ClusterProvision object, directly enabling extraction of unsecured credentials without needing Secrets access.
NVD Description
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision…
more
objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Deeper analysisAI
CVE-2025-2241, published on 2025-03-17, is a vulnerability in Hive, a component of Red Hat's Multicluster Engine (MCE) and Advanced Cluster Management (ACM). The flaw exposes vCenter credentials in the ClusterProvision object after provisioning a vSphere cluster. This allows users with read access to ClusterProvision objects to extract sensitive credentials without direct access to Kubernetes Secrets. It carries a CVSS score of 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) and maps to CWE-922.
Attackers require low privileges (PR:L), specifically read access to ClusterProvision objects, and can exploit it over the network (AV:N) without user interaction (UI:N), though it demands high attack complexity (AC:H). Exploitation grants high confidentiality and integrity impacts (C:H/I:H) across a changed scope (S:C), enabling unauthorized vCenter access, cluster management, and privilege escalation.
Red Hat's security advisory at https://access.redhat.com/security/cve/CVE-2025-2241, Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2351350, and the Hive fix in https://github.com/openshift/hive/pull/2612 provide details on patches and mitigation steps.
Details
- CWE(s)