~ / search / GHSA-3hw7-qj9h-r835

GHSA-3hw7-qj9h-r835

Gardener allows bypassing project secret validation which can lead to privilege escalation

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-47283

Packages

EcosystemPackageAffectedFixed in
Go github.com/gardener/gardener < 1.116.4 1.116.4
Go github.com/gardener/gardener >= 1.117.0, < 1.117.5 1.117.5
Go github.com/gardener/gardener >= 1.118.0, < 1.118.2 1.118.2

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. ### Am I Vulnerable? This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. ### Affected Components - `gardener/gardener` ### Affected Versions - < v1.116.4 - < v1.117.5 - < v1.118.2 - < v1.119.0 ### Fixed Versions - &gt;= v1.116.4 - &gt;= v1.117.5 - &gt;= v1.118.2 - &gt;= v1.119.0 ### How do I mitigate this vulnerability? Update to a fixed version.

References

External links from the advisory. They lead to third-party sites.