CVE-2025-47283 Bypassing project secret validation can lead to privilege escalation

What is CVE-2025-47283?

CVE-2025-47283 is a critical vulnerability in gardener, published on 19 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

Weakness: CWE-20

Which versions are affected by CVE-2025-47283?

7 open source packages ship an affected version, including github.com/gardener/gardener. It affects 1 product.

Products include Gardener Gardener.

How do I fix CVE-2025-47283?

Upgrade github.com/gardener/gardener to a fixed version for your release line: 1.116.4, 1.117.5 or 1.118.2.

Is CVE-2025-47283 being exploited?

There is no known exploitation of CVE-2025-47283 in the wild and no public exploit code.

Other vulnerabilities in gardener

• CVE-2025-47284 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation Critical 9.9
• CVE-2019-12494 Missing authorization in n/a High 8.5
• CVE-2018-2475 Missing authorization in project “Gardener” High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hw7-qj9h-r835, GO-2025-3696.