openshift github.com/openshift/hive vulnerabilities

Latest openshift github.com/openshift/hive CVEs

Newest publication first

1. CVE-2024-25132 Openshift-dedicated: hive: hibernation controller denial of service

   Published 2025-03-19

   Medium·CVSS 4.3 EPSS 0.34%

   A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with the spec.installed field set to true, regardless of the installation status, and a positive timespan for the spec.hibernat...

2. CVE-2025-2241 Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm

   Published 2025-03-17

   High·CVSS 8.2 EPSS 0.50%

   A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision ob...

3. CVE-2024-25133 Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation

   Published 2024-12-31

   High·CVSS 8.8 EPSS 0.49%

   A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.