gardener
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| gardener | 3 | – | Sep 22, 2026 |
| external-dns-management | 1 | – | May 19, 2025 |
| gardenctl-v2 | 1 | – | Dec 12, 2025 |
| gardener-extension-provider-aws | 1 | – | Sep 25, 2025 |
Exploited and recent CVEs
- CVE-2026-79767 Gardener: Authorization Bypass via Group Subject Injection 0.4%
- CVE-2025-67508 gardenctl is vulnerable to Command Injection when used with non‑POSIX shells 0.2%
- CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning 0.5%
- CVE-2025-47284 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation 0.5%
- CVE-2025-47283 Bypassing project secret validation can lead to privilege escalation 0.7%
- CVE-2025-47282 Malicious google credential in DNS secret can lead to privilege escalation 0.7%