CVE-2025-47284criticalCWE-150

CVE-2025-47284: falha crítica em gardener

Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar gardener+ Monitorar github.com/gardener/gardener

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.5%
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
gardener · gardener
CVEs relacionadas — gardener

No mesmo produto, das mais perigosas para as menos.

CVE-2025-47283CRITICALBypassing project secret validation can lead to privilege escalationEPSS 0.7%CVE-2026-79767MEDIUMGardener: Authorization Bypass via Group Subject InjectionEPSS 0.4%