Read the docs
TI-2025-29812 Aliases CVE-2025-47282GHSA-xwgg-m7fx-83wx

Malicious google credential in DNS secret can lead to privilege escalation

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user with administrative privileges for a shoot cluster, including administrative privileges for a single namespace of the shoot cluster, to obtain control over the seed cluster where the shoot cluster is managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. The affected component is `gardener/external-dns-management`. The `external-dns-management` component may also be deployed on the seeds by the `gardener/gardener-extension-shoot-dns-service` extension when the extension is enabled. In this case, all versions of the `shoot-dns-service` extension `<= v1.60.0` are affected by this vulnerability. Version 0.23.6 of Gardener External DNS Management fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00743 54th percentileScored 2026-11-07
Fix Fixed external-dns-management (gardener): 0.23.6github.com/gardener/external-dns-management (Go): 0.23.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gardenerexternal-dns-managementbefore 0.23.60.23.6Patch availableCNA
—github.com/gardener/external-dns-management (Go)before 0.23.60.23.6Patch availableGHSA-xwgg-m7fx-83wx
—github.com/gardener/gardener-extension-shoot-dns-service (Go)up to 1.6.0—No fix listedGHSA-xwgg-m7fx-83wx
  • external-dns-management Vendorgardener Affected before 0.23.6 Fixed in 0.23.6 Patch available CNA
  • github.com/gardener/external-dns-management (Go) Vendor— Affected before 0.23.6 Fixed in 0.23.6 Patch available GHSA-xwgg-m7fx-83wx
  • github.com/gardener/gardener-extension-shoot-dns-service (Go) Vendor— Affected up to 1.6.0 Fixed in — No fix listed GHSA-xwgg-m7fx-83wx

Remediation

  • Fix · CNA external-dns-management (gardener) Fixed in 0.23.6
  • Fix · GHSA-xwgg-m7fx-83wx github.com/gardener/external-dns-management (Go) Fixed in 0.23.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47282
  2. 2026-10-03 Alias added: GHSA-xwgg-m7fx-83wx

References

Advisory 1

Other 2

  • TI-2025-29813 Bypassing project secret validation can lead to privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2025-37262 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning CVSS 3.0CRITICAL 9.9
  • TI-2025-29814 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2019-09329 In Gardener before 0.20.0, incorrect access control in seed clusters allows information… CVSS 3.0HIGH 8.5
  • TI-2018-01854 Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot… CVSS 3.0HIGH 8.5
  • TI-2025-41264 gardenctl is vulnerable to Command Injection when used with non‑POSIX shells CVSS 3.1HIGH 8.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences