CVE-2025-47283
Last modified
CVE-2025-47283 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. `gardener/gardener` (`gardenlet`) is the affected component. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gardener | Gardener | < 1.116.4 |
| Gardener | Gardener | >= 1.117.0, < 1.117.5 |
| Gardener | Gardener | >= 1.118.0, < 1.118.2 |
References
- https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-47283?
How severe is CVE-2025-47283?
How do I fix CVE-2025-47283?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-47278Flask is a web server gateway interface (WSGI) web applicati…1.8
- CVE-2025-47279Undici is an HTTP/1.1 client for Node.js. Prior to versions …3.1
- CVE-2025-4728A vulnerability was found in SourceCodester Best Online News…9.8
- CVE-2025-47280Umbraco Forms is a form builder that integrates with the Umb…6.1
- CVE-2025-47281Kyverno is a policy engine designed for cloud native platfor…7.7
- CVE-2025-47282Gardener External DNS Management is an environment to manage…9.9
- CVE-2025-47284Gardener implements the automated management and operation o…9.9
- CVE-2025-47285Vyper is the Pythonic Programming Language for the Ethereum …2.9
- CVE-2025-47286Combodo iTop is a web based IT service management tool. In v…7.2
- CVE-2025-47287Tornado is a Python web framework and asynchronous networkin…7.5
- CVE-2025-47288Discourse Policy plugin gives the ability to confirm users h…3.5
- CVE-2025-47289CE Phoenix is a free, open-source eCommerce platform. A stor…9
Are you affected by CVE-2025-47283?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST