CVE-2025-59823 - CVE House
Back to Database
Status published Critical CVE-2025-59823

Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Vulnerability Description

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59823

Credits & Attribution

No credits recorded in the NVD database.

References

More from gardener

View All →
CVE-2025-67508
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells
High 8
CVE-2025-47284
Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation
Critical 9.9
CVE-2025-47283
Bypassing project secret validation can lead to privilege escalation
Critical 9.9
CVE-2025-47282
Malicious google credential in DNS secret can lead to privilege escalation
Critical 9.9
CVE-2019-12494
In Gardener before 0.20.0, incorrect access control in seed clusters...
High 8.5

Affected Vendor

Affected Software

gardener-extension-provider-aws
Vulnerable Versions:
< 1.64.0, < 1.55.0, < 1.49.0, < 1.46.0

Timeline

Official Publish: September 25th, 2025
Last Modified: September 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact