CVE-2025-47283Disclosure(gardener / gardener)

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

gardener CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835

Other references

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gardener

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

gardener

Products

gardener

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2025-47283

Full discourse1 post

0day Signal@0dayPublishing244d
Disclosure
🚨 CVE-2025-47283: Bypassing project secret validat... Project admin to seed cluster takeover in Gardener via secret validation bypass - lateral movement nightmare with 9.9 C... https://zerodaysignal.com/vulnerability/CVE-2025-47283 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2025-47283 enables project administrators to bypass secret validation in Gardener, allowing cluster takeover and lateral movement, but the post lacks details on patches, PoC, or active exploitation.
0000049
132 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gardener	gardener	-	-	-

Explore more

Back to dashboard gardener CVEs gardener vulnerabilities