critical9.9
CVE-2025-47283
Gardener allows bypassing project secret validation which can lead to privilege escalation
Impact
A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. ### Affected Components - `gardener/gardener` ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - >= v1.116.4 - >= v1.117.5 - >= v1.118.2 - >= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gardener/gardener | < 1.116.4 | 1.116.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gardener | Gardener | before 1.116.4 from 1.117.0 before 1.117.5 from 1.118.0 before 1.118.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/gardener/gardener/commit/924b1575aae052bcda5a51fac8594d38fa3c41b0
- https://github.com/gardener/gardener/commit/b89cf2cd5067e82f364063d5241af73650a6e11d
- https://github.com/gardener/gardener/commit/bbd19b1dd3a31843d7b820172d37f75298dfaf8b
- https://github.com/gardener/gardener/commit/cf4e9887d83902216b85609caf563f7a9dd2de00
- https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835
- https://github.com/advisories/GHSA-3hw7-qj9h-r835
- https://nvd.nist.gov/vuln/detail/CVE-2025-47283