PT-2025-39386 · Google+4 · Gcp Providers+5

Published 2025-09-25 · Updated 2025-10-27 · CVE-2025-59823

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Gardener versions prior to 1.64.0 (AWS providers) Project Gardener versions prior to 1.55.0 (Azure providers) Project Gardener versions prior to 1.49.0 (OpenStack providers) Project Gardener versions prior to 1.46.0 (GCP providers)

Description Project Gardener, a system for automated Kubernetes cluster management, may allow code injection in its extensions for AWS, Azure, OpenStack, and GCP providers. This could allow a user with administrative privileges for a Gardener project to gain control over the seed cluster managing the shoot cluster. The issue affects Gardener installations utilizing Terraformer for infrastructure provisioning with any of the affected components.

Recommendations Update Gardener Extensions for AWS providers to version 1.64.0 or later. Update Gardener Extensions for Azure providers to version 1.55.0 or later. Update Gardener Extensions for OpenStack providers to version 1.49.0 or later. Update Gardener Extensions for GCP providers to version 1.46.0 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

BDU:2026-00668

CVE-2025-59823

GHSA-227X-7MH8-3CF6

GO-2025-3981

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Aws Providers

Azure Providers

Gcp Providers

Openstack Providers

Project Gardener

Terraformer

References · 59

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59823.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59823 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-227x-7mh8-3cf6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59823 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00668 · Security Note
• https://osv.dev/vulnerability/GO-2025-3981 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6 · Note
• https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0 · Note
• https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2 · Note
• https://github.com/gardener/gardener-extension-provider-aws · Note
• https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0 · Note
• https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8 · Note
• https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0 · Note