CVE-2025-59823: 
vulnerability analysis and mitigation

CVE-2025-59823 is a Terraform code injection vulnerability in Project Gardener's cloud provider extensions that allows a user with administrative privileges for a Gardener project to obtain control over the seed cluster managing the shoot cluster. It affects gardener-extension-provider-aws prior to v1.64.0, gardener-extension-provider-azure prior to v1.55.0, gardener-extension-provider-openstack prior to v1.49.0, and gardener-extension-provider-gcp prior to v1.46.0. The vulnerability was disclosed on September 25, 2025, and has a CVSS v3.0 base score of 9.9 (Critical) (GitHub Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and arises when Terraformer is used for infrastructure provisioning within Gardener's cloud provider extensions. Insufficient input validation of shoot fields allows a project-level administrative user to inject malicious Terraform code that is subsequently executed by the Terraformer component. Because Terraformer operates with elevated privileges in the seed cluster, successful injection can escape the shoot cluster's security boundary and affect the broader seed cluster environment. The attack vector is network-based, requires low privileges (project admin), no user interaction, and results in a scope change (GitHub Advisory).

Successful exploitation grants an attacker full control over the seed cluster — the privileged Kubernetes cluster that manages one or more shoot (tenant) clusters — resulting in high confidentiality, integrity, and availability impact. An attacker could execute unauthorized code within the seed cluster, access sensitive cluster resources and credentials, disrupt managed Kubernetes infrastructure, and potentially pivot to other shoot clusters managed by the same seed. The scope change means the impact extends beyond the attacker's own Gardener project to the underlying shared infrastructure (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time (GitHub Advisory). The EPSS score is approximately 0.065%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to already hold administrative privileges within a Gardener project, which limits the attack surface but does not eliminate risk in multi-tenant Gardener deployments.

1. Obtain Project Admin Access: Gain or compromise administrative credentials for a Gardener project in an installation where Terraformer is enabled for infrastructure provisioning (AWS, Azure, GCP, or OpenStack provider).
2. Craft Malicious Shoot Configuration: Prepare a Shoot cluster resource manifest containing crafted input in provider-specific fields (e.g., infrastructure configuration) that embeds malicious Terraform HCL code or directives, exploiting the lack of input validation.
3. Submit the Malicious Shoot: Apply the crafted Shoot manifest via the Gardener API (e.g., kubectl apply -f malicious-shoot.yaml) using the compromised project admin credentials.
4. Trigger Terraformer Execution: Initiate or wait for the infrastructure reconciliation cycle, which causes the affected provider extension to pass the unsanitized input to the Terraformer component running in the seed cluster.
5. Achieve Seed Cluster Code Execution: The injected Terraform code executes within the Terraformer pod in the seed cluster, granting the attacker the ability to interact with seed cluster resources, exfiltrate credentials, or establish persistence (GitHub Advisory).

• Logs: Unexpected or malformed Terraform HCL content in Terraformer job logs within the seed cluster's namespace; Terraformer pods executing unusual external network calls or shell commands.
• Kubernetes Resources: Anomalous Terraformer Job or Pod objects created in seed cluster namespaces with unexpected environment variables or volume mounts; unexpected RBAC changes or new ClusterRoleBindings in the seed cluster.
• Network: Outbound connections from Terraformer pods to unexpected external IP addresses or domains not associated with the cloud provider APIs (AWS, Azure, GCP, OpenStack).
• File System: Unexpected files written to Terraformer pod working directories; evidence of credential files or kubeconfig data being accessed or exfiltrated from within Terraformer pods.

The primary remediation is to update all affected Gardener provider extensions to their patched versions: gardener-extension-provider-aws >= v1.64.0, gardener-extension-provider-azure >= v1.55.0, gardener-extension-provider-openstack >= v1.49.0, and gardener-extension-provider-gcp >= v1.46.0 (GitHub Advisory, AWS Release). As an interim measure where immediate patching is not possible, restrict administrative access to Gardener projects to the minimum necessary set of trusted users, and audit existing project admin assignments. Additionally, consider disabling Terraformer-based infrastructure provisioning if the flow-based reconciler is available as an alternative (notably, the OpenStack provider v1.49.0 defaults to the flow implementation and plans to disable Terraform reconciliation in v1.50.0).

The vulnerability was reported by security researcher petersutter and remediated by Gardener contributors kon-angelo and hebelsan, with coordination from JordanJordanov and donistz (GitHub Advisory). A summary blog post was published by ZeroPath shortly after disclosure (ZeroPath Blog). The vulnerability was also tracked by Red Hat, ENISA's EUVD, and national CERTs including Spain's CCN-CERT and INCIBE, reflecting broad awareness in the European security community.