What’s Vulnerable › Vulnerabilities
CVE-2025-47284: Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-19 · updated 2026-06-17
- Weakness: CWE-150
Description
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.
Affected products
- gardener: before 1.116.4; from 1.117.0 before 1.117.5; from 1.118.0 before 1.118.2 — fixed in 1.116.4, 1.117.5, 1.118.2
How to fix
Upgrade to a fixed version: gardener 1.116.4, 1.117.5, 1.118.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-47284 or the next vulnerability affects your stack