CVE-2025-47283

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-47283
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-47283.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-47283
Aliases
Published
2025-05-19T18:46:11.863Z
Modified
2025-12-02T20:05:05.360485Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Bypassing project secret validation can lead to privilege escalation
Details

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. gardener/gardener (gardenlet) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47283.json",
    "cwe_ids": [
        "CWE-20"
    ]
}
References

Affected packages

Git / github.com/gardener/gardener

Affected ranges

Type
GIT
Repo
https://github.com/gardener/gardener
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c533412feb8cb69967908ebdccd56d4456630b05
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.116.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/gardener/gardener
Events
Introduced
40401244c4b549a500956b9bef01870f146f6af6
Fixed
9824a8e4cd17fc93dee5e8a277d201c0ecab0676
Database specific 
{
    "versions": [
        {
            "introduced": "1.117.0"
        },
        {
            "fixed": "1.117.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/gardener/gardener
Events
Introduced
4f7855e9d8f5907785e8f6434f80d1117c74ff7b
Fixed
c6a60e3b4ca2765518e5c351459611e49c32337b
Database specific 
{
    "versions": [
        {
            "introduced": "1.118.0"
        },
        {
            "fixed": "1.118.2"
        }
    ]
}