CVE-2025-47284: gardener

Vulnerability summary

CVE-2025-47284 is a critical (CVSS 9.9) vulnerability in gardener. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.5% of scored vulnerabilities.

Timeline

1. 19-05-2025
   PublishedVulnerability first disclosed.
2. 20-05-2025
   Last modifiedVulnerability information updated.

Description

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed. This CVE affects all Gardener installations where gardener/gardener-extension-provider-gcp is in use. Versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 fix the issue.

• CWE-150Improper Neutralization of Escape, Meta, or Control SequencesThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.