← Back to CVEs

CVE-2025-47283

CRITICAL

9.9

Description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

CVE Details

CVSS v3.1 Score9.9

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published5/19/2025

Last Modified2/6/2026

Sourcenvd

Honeypot Sightings0

Affected Products

gardener:gardener

Weaknesses (CWE)

CWE-20

References

https://github.com/gardener/gardener/commit/924b1575aae052bcda5a51fac8594d38fa3c41b0(security-advisories@github.com)

https://github.com/gardener/gardener/commit/b89cf2cd5067e82f364063d5241af73650a6e11d(security-advisories@github.com)

https://github.com/gardener/gardener/commit/bbd19b1dd3a31843d7b820172d37f75298dfaf8b(security-advisories@github.com)

https://github.com/gardener/gardener/commit/cf4e9887d83902216b85609caf563f7a9dd2de00(security-advisories@github.com)

https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.