CVE-2025-47282 — Vulnerability in...

CRITICAL

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

Published May 19, 2025Updated May 23, 2025Source: osv

Summary

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project or a user with administrative privileges for a shoot cluster, including administrative privileges for a single namespace of the shoot cluster, to obtain control over the seed cluster where the shoot cluster is managed. ### Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. ### Affected Components - `gardener/external-dns-management` ### Affected Versions - < 0.23.6 ### Fixed Versions - >= 0.23.6 ### Important The `external-dns-management` component may also be deployed on the seeds by the https://github.com/gardener/gardener-extension-shoot-dns-service extension when the extension is enabled. In this case, all versions of the `shoot-dns-service` extension `<= v1.60.0` are affected by this vulnerability. ### How do I mitigate this vulnerability? Update to a fixed version.

Advisory Timeline

First published May 19, 2025 (511 days ago).
Last revised May 23, 2025 — 4 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/gardener/external-dns-management to 0.23.6 or later

go get github.com/gardener/external-dns-management@v0.23.6

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (2).

Package	Ecosystem	Affected	Fixed In
github.com/gardener/gardener-extension-shoot-dns-service	go	All versions	Range-based data available
github.com/gardener/external-dns-management	go	All versions	0.23.6

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE
CWE-269
Improper Privilege ManagementMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-47282?: Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2025-47282?: CVE-2025-47282 affects github.com/gardener/gardener-extension-shoot-dns-service and github.com/gardener/external-dns-management. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-47282 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-xwgg-m7fx-83wx

GO-2025-3697

Related CVEs

CVE-2025-59823
CRITICAL
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
CVE-2025-47283
CRITICAL
Gardener allows bypassing project secret validation which can lead to privilege escalation
CVE-2025-47284
CRITICAL
Gardener allows metadata injection for a project secret which can lead to privilege escalation
CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies