Gardener allows bypassing project secret validation which can lead to privilege escalation

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed clusters where their shoot clusters are managed. Am I Vulnerable? This CVE affects all Gardener installations no matter of the public...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining via the project secret validation process. An attacker can escalate privileges and potentially gain control over seed clusters by bypassing the intended security restrictions. Remediation Upgrade...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining via the project secret validation process. An attacker can escalate privileges and potentially gain control over seed clusters by bypassing the intended security restrictions. Remediation Upgrade...

GHSA-3HW7-QJ9H-R835 Gardener allows bypassing project secret validation which can lead to privilege escalation

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed clusters where their shoot clusters are managed. Am I Vulnerable? This CVE affects all Gardener installations no matter of the public...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining via the project secret validation process. An attacker can escalate privileges and potentially gain control over seed clusters by bypassing the intended security restrictions. Remediation Upgrade...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining via the project secret validation process. An attacker can escalate privileges and potentially gain control over seed clusters by bypassing the intended security restrictions. Remediation Upgrade...

CVE-2025-47284 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the gardenlet component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a...

CVE-2025-47282 Malicious google credential in DNS secret can lead to privilege escalation

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user...

CVE-2025-47282 Malicious google credential in DNS secret can lead to privilege escalation

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user...

CVE-2025-47282 Malicious google credential in DNS secret can lead to privilege escalation

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user...

MAL-2025-4292 Malicious code in @act-platform/app-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3567b231d7c053086778a968fabe2174ddda3fff11c78d9973d2827aaef8d4e8 Any computer that has this package installed or running should be considered...

MAL-2025-3996 Malicious code in hakai-xss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e8cc768298c405c50172bb23eff483fb8ceccc9bcaff232474cd9fc397e59cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in act1on3-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 164d9728bc36bd4864ac4b7b0aeebb622de7f64d90dd5cdaef72676d16c43b5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mp-cross (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53921b386b6a8061c81837604fae74f8719325a726df27664fb9ea723d2bbda8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3976 Malicious code in @cashcowprotocol/keccak-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169f38ea23bfdcebc0c858d32850cca112ca4aca633aae7914cd4ff6ff6b363d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dahsj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d072d2d70e89afc954cb7842944683428ca842513777b08d00ca91b0865a5c00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4040 Malicious code in web3author (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c522da4c7937de32f654a150ca5e926181795d3dfe8936f3ad6c58850e22cc78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4008 Malicious code in kendo-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c625b89207a2538d26f0a63c2df6530e4e8c1cd6ebccacfc59ebee9d74e840a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in js-lib-const (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02a729f8e6b9c15dea0d5d98728a6fa1585580d7c06587bd998cfb8e8a17760b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in social-network-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89279e5bb7b18cd7f18b0018f976d1e055fbeb331245019a6c3e75796c3bf1e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...