What is GHSA-9x73-87fh-54w9?

GHSA-9x73-87fh-54w9 is a security advisory published by GitHub Security Advisories with Critical severity. Gardener allows metadata injection for a project secret which can lead to privilege escalation

Which CVE IDs does GHSA-9x73-87fh-54w9 cover?

GHSA-9x73-87fh-54w9 covers the following CVE IDs: CVE-2025-47284. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9x73-87fh-54w9?

GHSA-9x73-87fh-54w9 has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

Which products are affected by GHSA-9x73-87fh-54w9?

GHSA-9x73-87fh-54w9 affects 3 products, including: go/github.com/gardener/gardener:\u003c 1.116.4; go/github.com/gardener/gardener:\u003e= 1.117.0, \u003c 1.117.5; go/github.com/gardener/gardener:\u003e= 1.118.0, \u003c 1.118.2.

GHSA-9x73-87fh-54w9CriticalCVSS 9.9

Gardener allows metadata injection for a project secret which can lead to privilege escalation

Vendor

GitHub Security Advisories

Published

May 19, 2025

Last Modified

May 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-47284 →

📋 Description

A security vulnerability was discovered in the gardenlet component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.

Am I Vulnerable?

This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.

Affected Components

gardener/gardener (gardenlet)

Affected Versions

< v1.116.4
< v1.117.5
< v1.118.2
< v1.119.0

Fixed Versions

>= v1.116.4
>= v1.117.5
>= v1.118.2
>= v1.119.0

How do I mitigate this vulnerability?

Update to a fixed version.

🎯 Affected products3

go/github.com/gardener/gardener:< 1.116.4
go/github.com/gardener/gardener:>= 1.117.0, < 1.117.5
go/github.com/gardener/gardener:>= 1.118.0, < 1.118.2