CVE-2025-6017

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-6017

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6017.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-6017

Published

2025-07-02T06:36:47Z

Modified

2026-08-12T03:51:44Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Rhacm: users with clusterreader role can see credentials from managed-clusters

Details

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-359"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6017.json"
}

References

Affected packages

Git / github.com/open-cluster-management-io/ocm

Affected ranges

Type

GIT

Repo

https://github.com/open-cluster-management-io/ocm

Events

Introduced

Fixed

57c78cd4de0c89908937eeb97798bb57fc3147cd

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.16.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.15.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6017.json"