Security readout for executives and security teams
Plain-English summary
Hive can leave vCenter credentials inside a ClusterProvision object after provisioning a vSphere cluster. Anyone permitted to read that object could obtain credentials despite lacking access to Kubernetes Secrets, potentially enabling unauthorized infrastructure management and privilege escalation.
Executive priority
Treat this as a high-priority credential exposure. Promptly scope affected vSphere provisioning environments, restrict object access, and coordinate vendor remediation and credential rotation. Infrastructure compromise is plausible if exposed credentials carry broad vCenter permissions.
Technical view
CVE-2025-2241 is a credential-exposure flaw in Hive, used by Red Hat MCE and ACM. Sensitive vCenter credentials remain accessible through ClusterProvision objects. Exploitation requires low privileges and read access to those objects. The supplied CVSS 3.1 score is 8.2, with high confidentiality and integrity impact across a changed security scope.
Likely exposure
Exposure is most likely where Hive, MCE, or ACM provisioned vSphere clusters and users or service accounts can read ClusterProvision objects. The bundle identifies Hive 1.2.4105-7735bf3 and affected Red Hat products, but does not provide complete MCE or ACM version boundaries.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Abuse requires authenticated read access to ClusterProvision objects, but successful access could bypass Kubernetes Secret permissions and expose credentials with substantial vCenter authority.
Researcher notes
CWE-922 and the changed-scope CVSS vector are consistent with insecure storage exposing credentials across authorization boundaries. Important unknowns include complete affected-version ranges, credential privilege levels, exposure duration, and whether historical objects retain values. No exploit activity or detailed vendor remediation is established by the supplied bundle.
Mitigation direction
- Check Red Hat guidance and the Hive pull request for applicable fixed releases before upgrading.
- Immediately restrict ClusterProvision read access to essential administrators and service accounts.
- Apply the vendor-supported remediation appropriate to the deployed Hive, MCE, or ACM release.
- Rotate potentially exposed vCenter credentials after remediation and investigate their prior use.
- Review vCenter account privileges and reduce them to the minimum operationally required.
Validation and detection
- Inventory deployed Hive, MCE, and ACM versions, then compare them with current Red Hat guidance.
- Enumerate users and service accounts with read access to ClusterProvision objects.
- Securely inspect current and historical ClusterProvision objects for persisted credentials without copying sensitive values.
- Review Kubernetes audit records and vCenter logs for unexpected object reads or administrative activity.
- After remediation, verify newly provisioned clusters no longer expose credentials through ClusterProvision objects.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-922: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-2241 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N1.85.8redhatVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2025-2241CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2351350CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/openshift/hive/pull/2612CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.