Read the docs
TI-2025-29813 Aliases CVE-2025-47283GHSA-3hw7-qj9h-r835

Bypassing project secret validation can lead to privilege escalation

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Fixed gardener (gardener): 1.116.4, 1.117.5, 1.118.2github.com/gardener/gardener (Go): 1.116.4, 1.117.5, 1.118.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gardenergardenerbefore 1.116.4; 1.117.0 to before 1.117.5; 1.118.0 to before 1.118.21.116.4, 1.117.5, 1.118.2Patch availableCNA
—github.com/gardener/gardener (Go)before 1.116.41.116.4Patch availableGHSA-3hw7-qj9h-r835
—github.com/gardener/gardener (Go)1.117.0 to before 1.117.51.117.5Patch availableGHSA-3hw7-qj9h-r835
—github.com/gardener/gardener (Go)1.118.0 to before 1.118.21.118.2Patch availableGHSA-3hw7-qj9h-r835
  • gardener Vendorgardener Affected before 1.116.4; 1.117.0 to before 1.117.5; 1.118.0 to before 1.118.2 Fixed in 1.116.4, 1.117.5, 1.118.2 Patch available CNA
  • github.com/gardener/gardener (Go) Vendor— Affected before 1.116.4 Fixed in 1.116.4 Patch available GHSA-3hw7-qj9h-r835
  • github.com/gardener/gardener (Go) Vendor— Affected 1.117.0 to before 1.117.5 Fixed in 1.117.5 Patch available GHSA-3hw7-qj9h-r835
  • github.com/gardener/gardener (Go) Vendor— Affected 1.118.0 to before 1.118.2 Fixed in 1.118.2 Patch available GHSA-3hw7-qj9h-r835

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*before 1.116.4; 1.117.0 to before 1.117.5; 1.118.0 to before 1.118.2Vulnerablegardener
  • cpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:* Versions before 1.116.4; 1.117.0 to before 1.117.5; 1.118.0 to before 1.118.2 Vulnerable ·gardener

Remediation

  • Fix · CNA gardener (gardener) Fixed in 1.116.4, 1.117.5, 1.118.2
  • Fix · GHSA-3hw7-qj9h-r835 github.com/gardener/gardener (Go) Fixed in 1.116.4 Advisory →
  • Fix · GHSA-3hw7-qj9h-r835 github.com/gardener/gardener (Go) Fixed in 1.117.5 Advisory →
  • Fix · GHSA-3hw7-qj9h-r835 github.com/gardener/gardener (Go) Fixed in 1.118.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47283
  2. 2026-10-03 Alias added: GHSA-3hw7-qj9h-r835
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 5

  • TI-2025-29814 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2019-09329 In Gardener before 0.20.0, incorrect access control in seed clusters allows information… CVSS 3.0HIGH 8.5
  • TI-2018-01854 Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot… CVSS 3.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences