GHSA-227x-7mh8-3cf6

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-59823

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/gardener/gardener-extension-provider-aws	< 1.64.0	1.64.0
Go	github.com/gardener/gardener-extension-provider-gcp	< 1.46.0	1.46.0
Go	github.com/gardener/gardener-extension-provider-azure	< 1.55.0	1.55.0
Go	github.com/gardener/gardener-extension-provider-openstack	< 1.49.0	1.49.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A security vulnerability was discovered in Gardener when [Terraformer](https://github.com/gardener/terraformer) is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This CVE affects all Gardener installations where [Terraformer](https://github.com/gardener/terraformer) is used/can be enabled for infrastructure provisioning with any of the affected components mentioned below. ### Affected Components • gardener-extension-provider-gcp • gardener-extension-provider-azure • gardener-extension-provider-openstack • gardener-extension-provider-aws ### Affected Versions • gardener-extension-provider-gcp < v1.46.0 • gardener-extension-provider-azure < v1.55.0 • gardener-extension-provider-openstack < v1.49.0 • gardener-extension-provider-aws < v1.64.0 ### Fixed versions • gardener-extension-provider-gcp >= v1.46.0 • gardener-extension-provider-azure >= v1.55.0 • gardener-extension-provider-openstack >= v1.49.0 • gardener-extension-provider-aws >= v1.64.0 ### How do I mitigate this vulnerability? Update to a fixed version.

References

External links from the advisory. They lead to third-party sites.