Red Hat Hive VCenter Credentials Exposure Vulnerability in Multicluster Engine and Advanced Cluster Management

A vulnerability in Hive, part of Red Hat's Multicluster Engine (MCE) and Advanced Cluster Management (ACM), allows VCenter credentials to be exposed in the ClusterProvision object after a VSphere cluster is provisioned. This occurs because the credentials, supplied via a Secret in the same namespace as the ClusterDeployment, are echoed back in the ClusterProvision object. Users with read access to ClusterProvision objects can extract these sensitive credentials, potentially leading to unauthorized access to VCenter, cluster management, and privilege escalation.

Impact

Exploitation of this vulnerability could result in unauthorized access to VCenter, allowing for improper cluster management and potential privilege escalation.