CVE-2025-2241: falha de alta gravidade em hive
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Red Hat Advanced Cluster Management for Kubernetes+ Monitorar multicluster engine for Kubernetes
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
hiveRed Hat · Multicluster Engine for KubernetesRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2CVEs relacionadas — hive
No mesmo produto, das mais perigosas para as menos.
CVE-2026-66786CRITICALSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsEPSS 1.4%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2024-1139HIGHCluster-monitoring-operator: credentials leakEPSS 0.9%CVE-2024-0874MEDIUMCoredns: cd bit response is cached and served laterEPSS 0.8%