CVE-2025-47283criticalCWE-20

CVE-2025-47283: falha crítica em gardener

Bypassing project secret validation can lead to privilege escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar gardener+ Monitorar github.com/gardener/gardener

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.7%
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
gardener · gardener
CVEs relacionadas — gardener

No mesmo produto, das mais perigosas para as menos.

CVE-2025-47284CRITICALGardener vulnerable to metadata injection for a project secret that can lead to privilege escalationEPSS 0.5%CVE-2026-79767MEDIUMGardener: Authorization Bypass via Group Subject InjectionEPSS 0.4%