CVE-2025-6017

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHBA-2025:11623
https://access.redhat.com/errata/RHBA-2025:9225
https://access.redhat.com/security/cve/CVE-2025-6017	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372362	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes::::::::
	cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes::::::::
	cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes::::::::

History

30 Oct 2026, 19:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHBA-2025:11623 - () https://access.redhat.com/errata/RHBA-2025:9225 -

Information

Published : 2025-07-02 07:15

Updated : 2026-10-30 19:17

NVD link : CVE-2025-6017

Mitre link : CVE-2025-6017

CVE.ORG link : CVE-2025-6017

JSON object : View

Products Affected

redhat

advanced_cluster_management_for_kubernetes

CWE

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

{"id": "CVE-2025-6017", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6017", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-02T13:13:28.618310Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"versions": [{"status": "affected", "version": "0", "lessThan": "0.16.0", "versionType": "semver"}], "packageName": "ocm", "collectionURL": "https://github.com/open-cluster-management-io/ocm", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.11.8-3", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-22", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-cli-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-cluster-permission-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-16", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-grafana-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-multicluster-observability-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-16", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-must-gather-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-38", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-prometheus-config-reloader-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-prometheus-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-indexer-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-api-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-19", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-siteconfig-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-15", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/cert-policy-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-16", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/cluster-backup-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-15", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/config-policy-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-15", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/endpoint-monitoring-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/governance-policy-propagator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/grafana-dashboard-loader-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-metrics-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/klusterlet-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/kube-rbac-proxy-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/kube-state-metrics-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/memcached-exporter-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/memcached-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/metrics-collector-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-21", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multiclusterhub-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-observability-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-7", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/node-exporter-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/observatorium-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-15", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/observatorium-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/prometheus-alertmanager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/prometheus-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/rbac-query-proxy-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/search-collector-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-16", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/submariner-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/thanos-receive-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.12::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9", "versions": [{"status": "unaffected", "version": "v2.12.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/thanos-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2025-07-02T07:15:23.293", "references": [{"url": "https://access.redhat.com/errata/RHBA-2025:11623", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHBA-2025:9225", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-6017", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372362", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-359"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors."}, {"lang": "es", "value": "Se detect\u00f3 una falla en Red Hat Advanced Cluster Management en las versiones 2.10 (anteriores a la 2.10.7), 2.11 (anteriores a la 2.11.4) y 2.12 (anteriores a la 2.12.4). Esta vulnerabilidad permite a un usuario sin privilegios acceder a las credenciales confidenciales del cl\u00faster administrado a trav\u00e9s de la interfaz de usuario. Esta informaci\u00f3n solo deber\u00eda ser accesible para usuarios autorizados y puede provocar la p\u00e9rdida de confidencialidad de la informaci\u00f3n administrativa, que podr\u00eda filtrarse a usuarios no autorizados."}], "lastModified": "2026-10-30T19:17:43.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "344CF216-2E92-488D-A2A7-46AB75008880", "versionEndExcluding": "2.10.7", "versionStartIncluding": "2.10"}, {"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B150B262-DB86-41D1-90D5-55E5C3C64B37", "versionEndExcluding": "2.11.4", "versionStartIncluding": "2.11"}, {"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25378F99-5C58-4CEF-ABC4-0D61842CA8BA", "versionEndExcluding": "2.12.4", "versionStartIncluding": "2.12"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}