Gardener allows bypassing project secret validation which can lead to privilege escalation
A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. ### Affected Components - `gardener/gardener` ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - >= v1.116.4 - >= v1.117.5 - >= v1.118.2 - >= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-47283US | critical9.9 | — | ||
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/gardener/gardenerPACKAGE
- https://github.com/gardener/gardener/commit/924b1575aae052bcda5a51fac8594d38fa3c41b0WEB
- https://github.com/gardener/gardener/commit/b89cf2cd5067e82f364063d5241af73650a6e11dWEB
- https://github.com/gardener/gardener/commit/bbd19b1dd3a31843d7b820172d37f75298dfaf8bWEB
- https://github.com/gardener/gardener/commit/cf4e9887d83902216b85609caf563f7a9dd2de00WEB
- https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-47283ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan