CVE-2025-47282
📋 TL;DR
A privilege escalation vulnerability in Gardener External DNS Management allows users with administrative privileges at the project or shoot cluster level to gain control over the seed cluster managing their resources. This affects all Gardener installations regardless of cloud provider. The vulnerability exists in the external-dns-management component and related extensions.
💻 Affected Systems
- gardener/external-dns-management
- gardener/gardener-extension-shoot-dns-service
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of seed cluster, allowing attacker to control all managed shoot clusters, exfiltrate sensitive data, deploy malicious workloads, or disrupt entire Kubernetes infrastructure.
Likely Case
Privileged users escalating their access from shoot/project level to seed cluster level, potentially gaining unauthorized access to other tenants' resources or cluster management functions.
If Mitigated
Limited impact if proper network segmentation, least privilege access controls, and monitoring are in place to detect unusual administrative activity.
🎯 Exploit Status
Exploitation requires administrative privileges at project or shoot cluster level. The advisory suggests the vulnerability is straightforward to exploit once privileged access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: external-dns-management 0.23.6, shoot-dns-service extension > v1.60.0
Vendor Advisory: https://github.com/gardener/external-dns-management/security/advisories/GHSA-xwgg-m7fx-83wx
Restart Required: Yes
Instructions:
1. Update external-dns-management to version 0.23.6 or later. 2. If using shoot-dns-service extension, update to version > v1.60.0. 3. Restart affected components. 4. Verify no unauthorized changes were made during vulnerable period.
🔧 Temporary Workarounds
Disable external-dns-management component
linuxTemporarily disable the vulnerable component if DNS management is not critical
kubectl scale deployment -n <namespace> external-dns-management --replicas=0
Restrict administrative access
allTighten RBAC controls to minimize users with administrative privileges
Review and audit all ClusterRoleBindings and RoleBindings with administrative permissions
🧯 If You Can't Patch
- Implement strict network segmentation between shoot and seed clusters
- Enhance monitoring and alerting for unusual administrative activities across cluster boundaries
🔍 How to Verify
Check if Vulnerable:
Check external-dns-management version: kubectl get deployment -n <namespace> external-dns-management -o jsonpath='{.spec.template.spec.containers[0].image}'. Check shoot-dns-service extension version in Gardener dashboard or configuration.Check Version:
kubectl get deployment -n <namespace> external-dns-management -o jsonpath='{.spec.template.spec.containers[0].image}'Verify Fix Applied:
Confirm external-dns-management image includes :0.23.6 or later tag. Verify shoot-dns-service extension version > v1.60.0 in Gardener configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual cross-cluster API calls
- Administrative actions from shoot clusters targeting seed cluster resources
- DNS configuration changes from unexpected sources
Network Indicators:
- Unexpected network traffic between shoot and seed cluster control planes
- API calls bypassing expected authorization boundaries
SIEM Query:
source="kubernetes" AND ("external-dns-management" OR "shoot-dns-service") AND ("privilege" OR "escalation" OR "unauthorized" OR "seed-cluster")