What is GHSA-3hw7-qj9h-r835?

GHSA-3hw7-qj9h-r835 is a security advisory published by GitHub Security Advisories with Critical severity. Gardener allows bypassing project secret validation which can lead to privilege escalation

Which CVE IDs does GHSA-3hw7-qj9h-r835 cover?

GHSA-3hw7-qj9h-r835 covers the following CVE IDs: CVE-2025-47283. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3hw7-qj9h-r835?

GHSA-3hw7-qj9h-r835 has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

Which products are affected by GHSA-3hw7-qj9h-r835?

GHSA-3hw7-qj9h-r835 affects 3 products, including: go/github.com/gardener/gardener:\u003c 1.116.4; go/github.com/gardener/gardener:\u003e= 1.117.0, \u003c 1.117.5; go/github.com/gardener/gardener:\u003e= 1.118.0, \u003c 1.118.2.

GHSA-3hw7-qj9h-r835CriticalCVSS 9.9

Gardener allows bypassing project secret validation which can lead to privilege escalation

Vendor

GitHub Security Advisories

Published

May 19, 2025

Last Modified

February 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-47283 →

📋 Description

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.

Am I Vulnerable?

This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters.

Affected Components

gardener/gardener

Affected Versions

< v1.116.4
< v1.117.5
< v1.118.2
< v1.119.0

Fixed Versions

>= v1.116.4
>= v1.117.5
>= v1.118.2
>= v1.119.0

How do I mitigate this vulnerability?

Update to a fixed version.

🎯 Affected products3

go/github.com/gardener/gardener:< 1.116.4
go/github.com/gardener/gardener:>= 1.117.0, < 1.117.5
go/github.com/gardener/gardener:>= 1.118.0, < 1.118.2