Critical, CVSS 9.9GoPublished
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
CVE-2025-59823 · GHSA-227x-7mh8-3cf6
- Affected
- Go github.com/gardener/gardener-extension-provider-openstack < 1.49.0
- Fixed in
- 1.49.0· Vendor fix available
- Issue
- Impact A security vulnerability was discovered in Gardener when Terraformer is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This CVE affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below. Affected Components • gardener-extension-provider-gcp • gardener-extension-provider-azure • gardener-extension-provider-openstack • gardener-extension-provider-aws Affected Versions • gardener-extension-provider-gcp < v1.46.0 • gardener-extension-provider-azure < v1.55.0 • gardener-extension-provider-openstack < v1.49.0 • gardener-extension-provider-aws < v1.64.0 Fixed versions • gardener-extension-provider-gcp = v1.46.0 • gardener-extension-provider-azure = v1.55.0 • gardener-extension-provider-openstack = v1.49.0 •…
Recommended action: Upgrade to 1.49.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.