CVE-2025-67508 - CVE House
Back to Database
Status published High CVE-2025-67508

gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

Vulnerability Description

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67508

Credits & Attribution

No credits recorded in the NVD database.

References

More from gardener

View All →
CVE-2025-59823
Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning
Critical 9.9
CVE-2025-47284
Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation
Critical 9.9
CVE-2025-47283
Bypassing project secret validation can lead to privilege escalation
Critical 9.9
CVE-2025-47282
Malicious google credential in DNS secret can lead to privilege escalation
Critical 9.9
CVE-2019-12494
In Gardener before 0.20.0, incorrect access control in seed clusters...
High 8.5

Affected Vendor

Affected Software

gardenctl-v2
Vulnerable Versions:
< 2.12.0

Timeline

Official Publish: December 12th, 2025
Last Modified: December 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control