CVE-2025-59823
published 2025-09-25CVE-2025-59823: Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions…
PriorityP265critical9.9CVSS 3.0
AVNACLPRLUINSCCHIHAH
EPSS
0.48%
37.6th percentile
Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gardener | gardener-extension-provider-aws | < 1.64.0 | 1.64.0 |
| gardener | gardener-extension-provider-aws | < 1.55.0 | 1.55.0 |
| gardener | gardener-extension-provider-aws | < 1.49.0 | 1.49.0 |
| gardener | gardener-extension-provider-aws | < 1.46.0 | 1.46.0 |
| github.com | gardener_gardener-extension-provider-aws | >= 0 < 1.64.0 | 1.64.0 |
| github.com | gardener_gardener-extension-provider-azure | >= 0 < 1.55.0 | 1.55.0 |
| github.com | gardener_gardener-extension-provider-gcp | >= 0 < 1.46.0 | 1.46.0 |
| github.com | gardener_gardener-extension-provider-openstack | >= 0 < 1.49.0 | 1.49.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
osv·2025-10-23
CVE-2025-59823 Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
OSV
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
osv·2025-09-25
CVE-2025-59823 [CRITICAL] Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
### Impact
A security vulnerability was discovered in Gardener when [Terraformer](https://github.com/gardener/terraformer) is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed.
This CVE affects all Gardener installations where [Terraformer](https://github.com/gardener/terraformer) is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below.
### Affected Components
• gardener-extension-provider-gcp
• gardener-extension-provider-azure
• gardener-extension-provider-openstack
• ga
GHSA
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
ghsa·2025-09-25
CVE-2025-59823 [CRITICAL] CWE-20 Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
### Impact
A security vulnerability was discovered in Gardener when [Terraformer](https://github.com/gardener/terraformer) is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed.
This CVE affects all Gardener installations where [Terraformer](https://github.com/gardener/terraformer) is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below.
### Affected Components
• gardener-extension-provider-gcp
• gardener-extension-provider-azure
• gardener-extension-provider-openstack
• ga
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0
2025-09-25
Published