CVE-2025-59823 — Vulnerability in...

CRITICAL

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

Published September 25, 2025Updated October 23, 2025Source: osv

Summary

### Impact A security vulnerability was discovered in Gardener when [Terraformer](https://github.com/gardener/terraformer) is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This CVE affects all Gardener installations where [Terraformer](https://github.com/gardener/terraformer) is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below. ### Affected Components • gardener-extension-provider-gcp • gardener-extension-provider-azure • gardener-extension-provider-openstack • gardener-extension-provider-aws ### Affected Versions • gardener-extension-provider-gcp < v1.46.0 • gardener-extension-provider-azure < v1.55.0 • gardener-extension-provider-openstack < v1.49.0 • gardener-extension-provider-aws < v1.64.0 ### Fixed versions • gardener-extension-provider-gcp >= v1.46.0 • gardener-extension-provider-azure >= v1.55.0 • gardener-extension-provider-openstack >= v1.49.0 • gardener-extension-provider-aws >= v1.64.0 ### How do I mitigate this vulnerability? Update to a fixed version.

Advisory Timeline

First published September 25, 2025 (382 days ago).
Last revised October 23, 2025 — 28 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/gardener/gardener-extension-provider-azure to 1.55.0 or later

go get github.com/gardener/gardener-extension-provider-azure@v1.55.0

Update github.com/gardener/gardener-extension-provider-aws to 1.64.0 or later

go get github.com/gardener/gardener-extension-provider-aws@v1.64.0

Update github.com/gardener/gardener-extension-provider-gcp to 1.46.0 or later

go get github.com/gardener/gardener-extension-provider-gcp@v1.46.0

Update github.com/gardener/gardener-extension-provider-openstack to 1.49.0 or later

go get github.com/gardener/gardener-extension-provider-openstack@v1.49.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: go (4).

Package	Ecosystem	Affected	Fixed In
github.com/gardener/gardener-extension-provider-azure	go	All versions	1.55.0
github.com/gardener/gardener-extension-provider-aws	go	All versions	1.64.0
github.com/gardener/gardener-extension-provider-gcp	go	All versions	1.46.0
github.com/gardener/gardener-extension-provider-openstack	go	All versions	1.49.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE
CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-59823?: Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2025-59823?: CVE-2025-59823 affects github.com/gardener/gardener-extension-provider-azure, github.com/gardener/gardener-extension-provider-aws and github.com/gardener/gardener-extension-provider-gcp (and 1 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-59823 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-227x-7mh8-3cf6

GO-2025-3981

Related CVEs

CVE-2025-47283
CRITICAL
Gardener allows bypassing project secret validation which can lead to privilege escalation
CVE-2025-47284
CRITICAL
Gardener allows metadata injection for a project secret which can lead to privilege escalation
CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2025-47282
CRITICAL
Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies