Gardener Privilege Escalation Vulnerability Allowing Control Over Seed Clusters

A critical vulnerability exists in Gardener versions prior to 1.116.4, 1.117.5, 1.118.2, and 1.119.0. This vulnerability allows users with administrative privileges in a Gardener project to gain control over the seed clusters managing their shoot clusters. The issue affects all Gardener installations, regardless of the public cloud provider used for the seed or shoot clusters.

Impact

Exploitation of this vulnerability could lead to unauthorized control over seed clusters, allowing for potential manipulation or management of resources within those clusters.

Remediation

Users are advised to update to Gardener versions 1.116.4, 1.117.5, 1.118.2, or 1.119.0.