CVE-2025-47284: Gardener allows metadata injection for a project secret which can lead to privilege escalation
A security vulnerability was discovered in the gardenlet component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. Am I Vulnerable? This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.
Published May 19, 2025
Affected packages
github.com/gardener/gardener
- Ecosystem
- Go
- Affected
- < 1.116.4
- Fixed in
- 1.116.4
- Check
go list -m github.com/gardener/gardener
github.com/gardener/gardener
- Ecosystem
- Go
- Affected
- >= 1.117.0, < 1.117.5
- Fixed in
- 1.117.5
- Check
go list -m github.com/gardener/gardener
github.com/gardener/gardener
- Ecosystem
- Go
- Affected
- >= 1.118.0, < 1.118.2
- Fixed in
- 1.118.2
- Check
go list -m github.com/gardener/gardener
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A security vulnerability was discovered in the gardenlet component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.
Am I Vulnerable?
This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.
Affected Components
gardener/gardener(gardenlet)
Affected Versions
- < v1.116.4
- < v1.117.5
- < v1.118.2
- < v1.119.0
Fixed Versions
- >= v1.116.4
- >= v1.117.5
- >= v1.118.2
- >= v1.119.0
How do I mitigate this vulnerability?
Update to a fixed version.
Credited to rfranzke, donistz, timuthy, JordanJordanov.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology