Security Flaw in Gardener Kubernetes Management by SAP
CVE-2025-47283
9.9CRITICAL
What is CVE-2025-47283?
A security vulnerability has been identified in Gardener's automated management of Kubernetes clusters, which could potentially allow an authorized user with administrative privileges within a specific Gardener project to gain unlawful control over the seed clusters managing their corresponding shoot clusters. This issue is applicable across all installations of Gardener, regardless of the public cloud service used for its operations. The vulnerability has been addressed in versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0, ensuring that users are protected from unauthorized access.
Affected Version(s)
gardener < 1.116.4 < 1.116.4
gardener >= 1.117.0, < 1.117.5 < 1.117.0, 1.117.5
gardener >= 1.118.0, < 1.118.2 < 1.118.0, 1.118.2