Gardener allows metadata injection for a project secret which can lead to privilege escalation

CVE-2025-47284 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

A security vulnerability was discovered in the gardenlet component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.

Am I Vulnerable?

This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.

Affected Components

  • gardener/gardener (gardenlet)

Affected Versions

  • < v1.116.4
  • < v1.117.5
  • < v1.118.2
  • < v1.119.0

Fixed Versions

  • &gt;= v1.116.4
  • &gt;= v1.117.5
  • &gt;= v1.118.2
  • &gt;= v1.119.0

How do I mitigate this vulnerability?

Update to a fixed version.

Basic information

Type
reviewed
Severity
critical
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2025-05-19 21:09:32 UTC
Updated
2025-05-19 21:48:48 UTC
GitHub reviewed
2025-05-19 21:09:32 UTC
NVD published
2025-05-19

EPSS Score

Score Percentile
0.26% 48.70%

CVSS Scores

Base score Version Severity Vector
9.9 3.0 —
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.

Identifiers

Type Value
GHSA GHSA-9x73-87fh-54w9 ↗
CVE CVE-2025-47284 ↗

CWEs

CWE id Name
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

Credits

  • rfranzke (remediation_developer)
  • donistz (coordinator)
  • timuthy (remediation_reviewer)
  • JordanJordanov (coordinator)

Affected packages (3)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go github.com/gardener/gardener < 1.116.4 1.116.4 —
go github.com/gardener/gardener >= 1.117.0, < 1.117.5 1.117.5 —
go github.com/gardener/gardener >= 1.118.0, < 1.118.2 1.118.2 —

References

cvelogic Threat Intelligence