CVE-2024-25133

HIGH 8.8

Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.

CWE	CWE-284
Published	Dec 31, 2024
Last Updated	Aug 27, 2025

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-25133 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2260372 github.com: https://github.com/openshift/hive/pull/2306

Credits

This issue was discovered by Thibault Guittet (Red Hat).