Log in Start free

Vulnerability · Published May 19, 2025 · Assigned by GitHub_M

CVE-2025-47283Bypassing project secret validation can lead to privilege escalation

Critical 9.9

In plain English

A critical-severity improper input validation in gardener from gardener. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)0.7%top 47.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/gardener/gardener1.116.4GHSA-3hw7-qj9h-r835
Gogithub.com/gardener/gardener1.117.5GHSA-3hw7-qj9h-r835
Gogithub.com/gardener/gardener1.118.2GHSA-3hw7-qj9h-r835
Gogithub.com/gardener/gardener1.116.4, 1.117.5, 1.118.2GO-2025-3696

Affected products (as reported)

VendorProductVersions
gardener gardener < 1.116.4>= 1.117.0, < 1.117.5>= 1.118.0, < 1.118.2

Weakness: CWE-20 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References