Skip to content
Gardener vulnerabilities
Newest
-
gardener
Gardener: Authorization Bypass via Group Subject Injection
CVE-2026-79767
Fix available
5.5 Medium
-
linuxfoundation gardenctl, gardener gardenctl-v2 +1 more
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells
CVE-2025-67508
Fix available
8.0 High
-
gardener gardener-extension-provider-aws
Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning
CVE-2025-59823
Fix available
9.9 Critical
-
gardener
Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation
CVE-2025-47284
Fix available
9.9 Critical
-
gardener
Bypassing project secret validation can lead to privilege escalation
CVE-2025-47283
Fix available
9.9 Critical
-
gardener external-dns-management
Malicious google credential in DNS secret can lead to privilege escalation
CVE-2025-47282
Fix available
9.9 Critical
-
gardener
In Gardener before 0.20.0, incorrect access control in seed clusters allows information...
CVE-2019-12494
8.5 High
-
gardener, sap project “gardener” +1 more
Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster...
CVE-2018-2475
8.5 High