CVE-2025-47284
Gardener allows metadata injection for a project secret which can lead to privilege escalation
Impact
A security vulnerability was discovered in the `gardenlet` component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use. ### Affected Components - `gardener/gardener` (`gardenlet`) ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - >= v1.116.4 - >= v1.117.5 - >= v1.118.2 - >= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gardener/gardener | < 1.116.4 | 1.116.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gardener | Gardener | before 1.116.4 from 1.117.0 before 1.117.5 from 1.118.0 before 1.118.2 |