Introduction
One misconfigured extension in a Kubernetes management platform can compromise an entire cloud estate. Project Gardener, a widely adopted open-source system for automating Kubernetes cluster operations across multiple clouds, recently disclosed a critical code injection vulnerability in its provider extensions. The issue affects the AWS, Azure, OpenStack, and GCP integrations. It could let an attacker with administrative project access take control of seed clusters and all the shoot clusters they manage.
About Project Gardener: Project Gardener is an open-source Kubernetes cluster management platform. SAP originally developed it, and it is now part of the Cloud Native Computing Foundation (CNCF). Organizations use it to automate the lifecycle of Kubernetes clusters across AWS, Azure, GCP, OpenStack, and other providers. Enterprises adopt Gardener when they want multi-cloud flexibility and consistent cluster operations at scale.
Technical information
CVE-2025-59823 is a code injection vulnerability (CWE-94) in Gardener's cloud provider extensions for AWS, Azure, OpenStack, and GCP. The flaw is in how these extensions handle user-supplied configuration data, specifically the providerConfig field in Infrastructure resources, before they pass it to the Terraformer component.
Terraformer provisions cloud infrastructure using Terraform. The vulnerable extensions do not adequately sanitize or validate the providerConfig input, so an attacker with administrative privileges in a Gardener project can inject arbitrary code. When Terraformer processes that input, it runs the injected code with the privileges of the seed cluster, which manages all associated shoot clusters.
Root cause:
- Extension controllers do not sufficiently validate or sanitize
providerConfigin Infrastructure resources. - User-controlled configuration goes straight to Terraformer, which executes it as part of infrastructure provisioning.
Impact:
- An attacker can fully compromise the seed cluster.
- Every shoot cluster managed by the compromised seed can be affected.
- The attack requires administrative privileges within a Gardener project, but enterprise environments commonly assign these.
The advisories and release notes include no public code snippets and do not identify the vulnerable lines. The vulnerability is systemic to the extension architecture and the Terraformer integration.
Affected systems and versions
- Gardener Extension Provider AWS: All versions before 1.64.0
- Gardener Extension Provider Azure: All versions before 1.55.0
- Gardener Extension Provider OpenStack: All versions before 1.49.0
- Gardener Extension Provider GCP: All versions before 1.46.0
Vulnerable configurations: any Gardener installation that uses Terraformer for infrastructure provisioning with the provider extensions listed above.
Vendor security history
Project Gardener has previously fixed privilege escalation and extension-related vulnerabilities, including:
- CVE-2025-47283: Project secret validation bypass leading to privilege escalation.
- CVE-2025-47284: Issues in the gardenlet component affecting cluster management.
The vendor disclosed this vulnerability responsibly and coordinated patches across all affected extensions, which points to a mature and responsive security process.
