Loading...
Skip to main content
GeekWala

CVE-2025-47283 — Vulnerability in github.com/gardener/gardener —...

CRITICAL

Gardener allows bypassing project secret validation which can lead to privilege escalation

Published May 19, 2025Updated February 6, 2026Source: osv

Summary

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. ### Affected Components - `gardener/gardener` ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - &gt;= v1.116.4 - &gt;= v1.117.5 - &gt;= v1.118.2 - &gt;= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.

Advisory Timeline

  • First published May 19, 2025 (511 days ago).
  • Last revised February 6, 2026 — 263 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/gardener/gardener to 1.118.2 or later
go get github.com/gardener/gardener@v1.118.2
Go
Update github.com/gardener/gardener to 1.116.4 or later
go get github.com/gardener/gardener@v1.116.4
Go
Update github.com/gardener/gardener to 1.117.5 or later
go get github.com/gardener/gardener@v1.117.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/gardener/gardener
go
All versions1.118.2
github.com/gardener/gardener
go
All versions1.116.4
github.com/gardener/gardener
go
All versions1.117.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-20
    Improper Input ValidationMITRE
  • CWE-269
    Improper Privilege ManagementMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-47283?
Gardener allows bypassing project secret validation which can lead to privilege escalation This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2025-47283?
CVE-2025-47283 affects github.com/gardener/gardener. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-47283 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-3hw7-qj9h-r835
GO-2025-3696

Related CVEs

  • CVE-2025-59823
    CRITICAL

    Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

  • CVE-2025-47284
    CRITICAL

    Gardener allows metadata injection for a project secret which can lead to privilege escalation

  • CVE-2026-107806
    CRITICAL

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

  • CVE-2026-68582
    CRITICAL

    Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • CVE-2025-47282
    CRITICAL

    Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies