CVE-2025-47284 is a critical flaw (CVSS 9.9) in the gardenlet component of Gardener. A project admin could gain control of the seed clusters that run their shoot clusters. It affects installs that use the GCP provider extension. Fixed in 1.116.4, 1.117.5, 1.118.2 and 1.119.0.
What's affected
The record says gardenlet in Gardener before 1.116.4, 1.117.5, 1.118.2 and 1.119.0 is affected. The advisory title is "Metadata injection for a project secret can lead to privilege escalation".
The scope is narrower than its sibling CVE-2025-47283. The advisory says this CVE affects Gardener installations where gardener-extension-provider-gcp is in use. If you do not run that extension, this record does not apply to you, but the sibling record does, and both have the same fixes.
Fixed versions by release line:
- 1.116.4
- 1.117.5
- 1.118.2
- 1.119.0
How to check if you're exposed
First decide whether you use the GCP provider extension at all. In a Gardener landscape, look at the registered extensions and the seeds or shoots that use GCP.
kubectl get controllerregistrations
kubectl get seeds
The exact resource names depend on your setup, so check them against your Gardener documentation. Then read the version of the gardenlet running in each seed. Anything below the fixed release for its line is affected.
If you use a managed Gardener offering, ask the operator two things: do they use the GCP extension, and have they moved to a fixed gardenlet.
What to do now
- List every seed and the gardenlet version it runs.
- Upgrade to 1.116.4, 1.117.5, 1.118.2, 1.119.0 or a later release.
- Confirm the new gardenlet is live on every seed after the rollout.
- Review who has administrative rights on Gardener projects, and trim the list.
- Because the sibling CVE applies to every install, treat the upgrade as mandatory even if you do not use GCP.
The advisory gives one mitigation: update to a fixed version.
Why it matters
The record maps this flaw to CWE-150, improper neutralization of escape, meta or control sequences. The product takes input from one component and passes it to another without neutralizing special elements that the downstream component may interpret. The advisory title points at metadata for a project secret as the place where that happens, and it does not go further than that.
The result is a privilege boundary failure. A project admin is supposed to manage shoots, not the seed clusters under them. The vector reads as a network attack, low complexity, low privileges, no user interaction, with changed scope and high impact on all three security properties. That combination gives 9.9.
This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say it is exploited. It matters because of how much sits behind a seed cluster, which can host the control planes of many shoot clusters.
Platform teams often treat project admins as trusted. This flaw is a reminder that a trusted role still needs a hard boundary around it.
Quick check
I do not use GCP. Do I still need to upgrade?
Yes. The advisory for the sibling CVE-2025-47283 says it affects all Gardener installations whatever the cloud provider, and it has the same fixed versions.
Which component needs the fix?
The affected component is gardenlet, part of gardener/gardener. Upgrading Gardener to a fixed release brings in the fixed gardenlet.
You can check your own dependency manifests for known issues with the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 18 October 2026.
