← Back

CVE-2025-47284

nvd nist
Published: May 19, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: NVD

Description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

Affected (3)

Products: Gardener: Gardener
Gardener
1 product
Gardener
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Gardener
Gardener
Before 1.116.4
Gardener
From 1.117.0 to 1.117.5
Gardener
From 1.118.0 to 1.118.2

Related CWEs

CWE-150
Improper Neutralization of Escape, Meta, or Control Sequences
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (1)

Source: security-advisories@github.com
Third Party Advisory

Timeline

No history available yet.