CVE-2025-47283: Bypassing project secret validation can lead to privilege escalation
A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.
Am I Vulnerable?
This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters.
Affected Components
- gardener/gardener
Affected Versions
- < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0
Fixed Versions
- >= v1.116.4 - >= v1.117.5 - >= v1.118.2 - >= v1.119.0
How do I mitigate this vulnerability?
Update to a fixed version.
Other sources
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. gardener/gardener (gardenlet) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47283?
CVE-2025-47283 is classified as a critical vulnerability due to the potential unauthorized access it allows.
How do I fix CVE-2025-47283?
To fix CVE-2025-47283, upgrade Gardener and gardenlet to versions higher than 1.116.4, 1.117.5, 1.118.2, and 1.119.0.
What types of systems are affected by CVE-2025-47283?
CVE-2025-47283 affects the Gardener and gardenlet products prior to specified versions.
What could an attacker do with CVE-2025-47283?
An attacker with administrative privileges could exploit CVE-2025-47283 to compromise the security of the Kubernetes clusters managed by Gardener.
Is there a mitigation strategy for CVE-2025-47283?
Yes, the primary mitigation strategy for CVE-2025-47283 is to immediately upgrade to the patched versions of Gardener and gardenlet.