gardener — Vulnerabilities & Security Advisories 5

Gardener is an open-source platform for managing Kubernetes-based garden clusters, enabling automated deployment and lifecycle management of applications. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues due to improper input validation and insecure default configurations. The platform's CVE history reveals consistent weaknesses in its API endpoints and web interfaces, with five documented vulnerabilities including RCE through crafted requests and XSS via unsanitized user inputs. While no major public incidents have been reported, the recurring nature of these flaws suggests potential risks in multi-tenant environments where compromised gardens could impact hosted applications.