CVE-2025-47283

An improper input validation error (CWE-20) in the `gardenlet` component allows a privileged user of the Gardener project to perform actions beyond their normal scope of permissions. As a result of exploiting the vulnerability, an attacker can go beyond the boundaries of their project and gain unauthorized access to the seed cluster infrastructure, which serves multiple users and many shoot clusters. The attack does not require victim interaction or special network conditions — only administrative privileges within the Gardener project are needed.

An attacker can take full control of seed cluster(s), leading to a breach of confidentiality, integrity, and availability of both the seed infrastructure and all shoot clusters managed by it belonging to other users.

Gardener must be updated immediately to version 1.116.4, 1.117.5, 1.118.2, or 1.119.0 (depending on the branch in use). Fixes were introduced in the above-mentioned versions by the project maintainers. Details are available in security advisory GHSA-3hw7-qj9h-r835.

All Gardener installations (`gardener/gardener`, `gardenlet` component) in versions earlier than 1.116.4, 1.117.5, 1.118.2, and 1.119.0, regardless of the public cloud provider used.