CVE-2025-47284

criticalpriority · track · 40EPSS 0.005 · 40 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 9.9 · critical

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

cvss

Technical severity, 0–10. One row per scoring source.

9.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.1 · impact 6

v3.09.9criticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.09.9criticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 3.1 · impact 6

v3.09.9criticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-150USCWE-150US

affected products (9)

Products and version ranges known to be affected.

gardener gardener≤ < 1.116.4enisa_euvdEU
gardener gardener1.117.0, → 1.117.5enisa_euvdEU
gardener gardener1.118.0, → 1.118.2enisa_euvdEU
gardener gardener< 1.116.4nvdUScpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*
gardener gardener1.117.0 → 1.117.5nvdUScpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*
gardener gardener1.118.0 → 1.118.2nvdUScpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*
Go github.com/gardener/gardener< 1.116.4osvUSpkg:golang/github.com/gardener/gardener
Go github.com/gardener/gardener1.117.0 → 1.117.5osvUSpkg:golang/github.com/gardener/gardener
Go github.com/gardener/gardener1.118.0 → 1.118.2osvUSpkg:golang/github.com/gardener/gardener

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-9x73-87fh-54w9Gardener allows metadata injection for a project secret which can lead to privilege escalation2025-05-19ghsa · osvUS
A security vulnerability was discovered in the `gardenlet` component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use. ### Affected Components - `gardener/gardener` (`gardenlet`) ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - >= v1.116.4 - >= v1.117.5 - >= v1.118.2 - >= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.
GO-2025-3698Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener2025-05-23vendor · osvUS
Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2025-05-19modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan