CVE-2025-2241

HighCVSS 8.2/10Last modified Oct 31, 2026

Description

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-922

Affected software

VendorProductVersions
——>= 1.2.4105-7735bf3, <= 1.1.16
Red HatMulticluster Engine for Kubernetes—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—

References

Timeline

Published
Mar 17, 2025
Last modified
Oct 31, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-224108.4In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of priCVE-2025-224118.8In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remCVE-2025-224128.8In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proxCVE-2025-224134.0In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local infCVE-2025-224147.8In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This coulCVE-2025-224154.0In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilCVE-2025-224167.8In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to localCVE-2025-224177.3In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. TCVE-2025-224187.8In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no CVE-2025-224197.3In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlaCVE-2025-22428.8An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 pCVE-2025-224207.8In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local e
CVE-2025-2241: High severity, CVSS 8.2 | Vulnix