VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gardener/gardener: vulnerability history, versions and safety

github.com/gardener/gardener is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from May 2025 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
6 vulnerabilities recorded C2 M1 U3
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 01 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gardener/gardener vulnerabilities

Vulert verdict on github.com/gardener/gardener v1.153.2 i

Updated on 23 Oct 2026

Careful: v1.153.2 has 6 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.153.2 — affected i
  • Vulnerabilities on record 6 over 1 year · 2 in the last year i
  • Latest disclosure 01 Oct 2026 i
  • Highest CVSS 9.9 i
  • With no published fix 1 i
  • Stars 3,477 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gardener/gardener, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022130834-4df3a9a5bb39 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261022130834-4df3a9a5bb39 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.151.4 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261022092304-4617b2eefb86 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261022092304-4617b2eefb86 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.152.2 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.153.2 22 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261021124745-97d1aa20dd35 21 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261021111323-e0cb5b5953a2 21 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261021084853-8925a5ed1aa3 21 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261020201233-a9cb37682859 20 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261020201233-a9cb37682859 20 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261019182621-132027d0b6a7 19 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261019134723-90b46fbf15d6 19 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261019112045-2e8034832f86 19 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261019084643-d267bb55364c 19 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261018220636-217d799afc50 18 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261017232323-81f1293669e9 17 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261017094724-a8a1897fbe64 17 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261017094724-a8a1897fbe64 17 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261017044637-197bd3324b87 17 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261016211233-49e38037084e 16 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261016125817-72ddaa32813e 16 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261016091516-8c10fe195d6e 16 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015194237-cd8009844f62 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261015194237-cd8009844f62 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015181758-e83538216c0f 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015164333-ad06f45bd26c 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261015164333-ad06f45bd26c 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015135134-84265be41fde 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261015135134-84265be41fde 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.153.1 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015102937-29c34f8885ec 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261015102937-29c34f8885ec 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015093301-1b760de52e80 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261015072247-e4bb3ea3a0ba 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261015072247-e4bb3ea3a0ba 15 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014180718-4e5dad713d05 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014164029-537b670b6ab9 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014144031-3224a0fbb4b3 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014090930-39d182ad5eff 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014064235-1698ade8e970 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261014010427-665d51ad1872 14 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013232828-d3ac9416943d 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013220027-38ca2c167d42 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013182729-c9cf502357eb 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013153255-37c562b6b040 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013125108-bc1d013d0047 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013112505-e35978a56a30 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261013062704-65a50cc55805 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013062704-65a50cc55805 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261013022650-e4a91f13a7a2 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261013022650-e4a91f13a7a2 13 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261012132325-9b6a4cb870b3 12 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261012132325-9b6a4cb870b3 12 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261012100743-3ceec14bca9f 12 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261012083539-fe98b9fde2f1 12 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261010203023-f624c08c709b 10 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261010203023-f624c08c709b 10 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261009190233-58d1ab917638 09 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261009190233-58d1ab917638 09 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261009145625-fc9257360768 09 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261009145625-fc9257360768 09 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261009111526-f2785003a9c8 09 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261008211057-16ed1f6cc965 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261008211057-16ed1f6cc965 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261008171222-34ac23859520 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.150.4 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261008145855-c354a11bb82e 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261008145855-c354a11bb82e 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.153.0 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.152.1 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.151.3 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261008124319-c79fe4f68034 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261008124319-c79fe4f68034 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261008104218-d8275ffdfca7 08 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261006144838-035083e8ab94 06 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261006120056-cebdcc4c0f17 06 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261006083357-0845e2ba7b91 06 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261006083357-0845e2ba7b91 06 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261005114404-92a252c0041e 05 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261004132804-b6401aea2b13 04 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261003225100-ea9ccfb26843 03 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261002171439-af7edf21c1b1 02 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261002114930-8d067240f528 02 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261002114930-8d067240f528 02 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261002072929-b352d996b596 02 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261001113827-8db7004bf8b9 01 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20261001042445-1da8bcb391e2 01 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20261001042445-1da8bcb391e2 01 Oct 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260930085724-fbdbe7da9016 30 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260930031454-b2f8034f7358 30 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260928143104-09d3b4dfd52c 28 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.151.2 28 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20260926163804-2e1b5d259973 26 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260926163804-2e1b5d259973 26 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260925212204-0b8f018f13db 25 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v0.0.0-20260925163213-2983efa2bb96 25 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260925163213-2983efa2bb96 25 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.150.3 25 Sep 2026 C2 M1 U3 Apache-2.0 No Details →
v1.73.1-0.20260925110819-1cfe8b995f18 25 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260924141625-e3589e6bf0e9 24 Sep 2026 C2 M1 U3 — No Details →
v1.149.5 24 Sep 2026 C2 M1 U3 — No Details →
v1.152.0 24 Sep 2026 C2 M1 U3 — No Details →
v0.0.0-20260924080253-ca95a43699c0 24 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260924080253-ca95a43699c0 24 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260923084920-16c2d522d0eb 23 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260921191656-8140ae1c26f3 21 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260921130405-91b19037ecb1 21 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260920190035-7c96f6f7a11a 20 Sep 2026 C2 M1 U3 — No Details →
v1.151.1 19 Sep 2026 C2 M1 U3 — No Details →
v0.0.0-20260918192639-8cfbdf32fd53 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918192639-8cfbdf32fd53 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918142532-967003168c08 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918124346-26f3a686d3c1 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918105846-f64936e55f58 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918085920-e3021cda7da9 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260918051229-ba0671922f06 18 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260915232327-9ce59a3ac79a 15 Sep 2026 C2 M1 U3 — No Details →
v1.73.1-0.20260915041253-514a31f2b70b 15 Sep 2026 C2 M1 U3 — No Details →

The newest 120 of 6,174 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 4
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 6 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gardener/gardener

The 5 most severe of 6 vulnerabilities recorded for this package

Search all 6 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Critical Privilege Escalation Vulnerability in Gardener Package 9.9 critical 1.116.4 19 May 2025
CVE-2025-47284: Gardener Metadata Injection Vulnerability Leading to Privilege Escalation 9.9 critical 1.116.4 19 May 2025
CVE-2026-79767: Gardener Authorization Bypass via Group Subject Injection 5.5 medium 1.142.6 22 Sep 2026
CVE-2025-47283: Privilege Escalation Vulnerability in Gardener Package N/A unrated 1.116.4 23 May 2025
CVE-2025-47284: Gardener Project Secret Metadata Injection Leading to Privilege Escalation N/A unrated 1.116.4 23 May 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gardener/gardener

Is github.com/gardener/gardener safe to use?

Vulert records 6 vulnerabilities for github.com/gardener/gardener in Go: 2 critical, 0 high, 1 medium and 0 low, plus 3 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/gardener/gardener's Vulert package health score?

Vulert scores github.com/gardener/gardener 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/gardener/gardener affected?

Yes. v1.153.2, the version you would install today, has 6 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/gardener/gardener have?

6 vulnerabilities are recorded for github.com/gardener/gardener in the Go ecosystem: 2 critical, 0 high, 1 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gardener/gardener vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/gardener/gardener in the last 12 months, and the oldest entry in this database dates to 19 May 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gardener/gardener are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gardener/gardener for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gardener/gardener version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.