Read the docs
TI-2018-01854 Aliases CVE-2018-2475GHSA-g482-4r7c-68g6

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4.

Why it matters now

EPSS 0.01348 71st percentileScored 2026-11-07
Fix Fixed project “Gardener” (SAP): 0.12.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPproject “Gardener”before 0.12.40.12.4Patch availableCNA
  • project “Gardener” VendorSAP Affected before 0.12.4 Fixed in 0.12.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*before 0.12.4Vulnerablegardener
  • cpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:* Versions before 0.12.4 Vulnerable ·gardener

Remediation

  • Fix · CNA project “Gardener” (SAP) Fixed in 0.12.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-2475
  2. 2026-10-03 Alias added: GHSA-g482-4r7c-68g6

References

Advisory 2

Other 1

  • TI-2025-22522 Missing Authorization check in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-15842 Path traversal in SAP NetWeaver KEVCVSS 3.1CRITICAL 9.9
  • TI-2020-05139 Missing authentication in SAP NetWeaver AS JAVA KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-05063 Missing authentication in SAP Solution Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-00284 Deserialization of untrusted data in SAP Commerce Cloud KEVCVSS 3.1CRITICAL 9.8
See all 1967 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences