CVE-2025-47283: gardener Improper Input Validation

EPSS trend

Probability

0.68%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

+0.04 pp

From 0.63% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

7 links

github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835X Refsource CONFIRMWEBAdvisoryThird Party Advisory
github.com/gardener/gardener/commit/924b1575aae052bcda5a51fac8594d38fa3c41b0X Refsource MISCWEB
github.com/gardener/gardener/commit/b89cf2cd5067e82f364063d5241af73650a6e11dX Refsource MISCWEB
github.com/gardener/gardener/commit/bbd19b1dd3a31843d7b820172d37f75298dfaf8bX Refsource MISCWEB
github.com/gardener/gardener/commit/cf4e9887d83902216b85609caf563f7a9dd2de00X Refsource MISCWEB
nvd.nist.gov/vuln/detail/CVE-2025-47283Advisory
github.com/gardener/gardenerPACKAGE

Related vulnerabilities

CVE-2018-2475gardenergardener+11.35%8y ago09-10-2018 13:00Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4.CVE-2025-47284gardenergardener+10.47%1y ago19-05-2025 18:52Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.CVE-2019-12494gardenergardener1.89%7y ago05-06-2019 18:44In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.CVE-2026-79767gardenergardener+20.39%28d ago22-09-2026 19:58Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

All vulnerabilities ingardener

CVE-2025-47283: gardener Improper Input Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References