Read the docs
TI-2025-41264 Aliases CVE-2025-67508GHSA-fw33-qpx7-rhx2

gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

Priority LOW 38CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed gardenctl-v2 (gardener): 2.12.0github.com/gardener/gardenctl-v2 (Go): 0.0.0-20251107111549-0bdc484cb5fb

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gardenergardenctl-v2before 2.12.02.12.0Patch availableCNA
—github.com/gardener/gardenctl-v2 (Go)before 0.0.0-20251107111549-0bdc484cb5fb0.0.0-20251107111549-0bdc484cb5fbPatch availableGHSA-fw33-qpx7-rhx2
  • gardenctl-v2 Vendorgardener Affected before 2.12.0 Fixed in 2.12.0 Patch available CNA
  • github.com/gardener/gardenctl-v2 (Go) Vendor— Affected before 0.0.0-20251107111549-0bdc484cb5fb Fixed in 0.0.0-20251107111549-0bdc484cb5fb Patch available GHSA-fw33-qpx7-rhx2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:gardenctl:*:*:*:*:*:*:*:*before 2.12.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:gardenctl:*:*:*:*:*:*:*:* Versions before 2.12.0 Vulnerable ·backstage

Remediation

  • Fix · CNA gardenctl-v2 (gardener) Fixed in 2.12.0
  • Fix · GHSA-fw33-qpx7-rhx2 github.com/gardener/gardenctl-v2 (Go) Fixed in 0.0.0-20251107111549-0bdc484cb5fb Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67508
  2. 2026-10-03 Alias added: GHSA-fw33-qpx7-rhx2

References

Advisory 2

Other 2

  • TI-2025-29813 Bypassing project secret validation can lead to privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2025-29812 Malicious google credential in DNS secret can lead to privilege escalation CVSS 3.0CRITICAL 9.9
  • TI-2025-37262 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning CVSS 3.0CRITICAL 9.9
  • TI-2025-29814 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation CVSS 3.1CRITICAL 9.9
  • TI-2019-09329 In Gardener before 0.20.0, incorrect access control in seed clusters allows information… CVSS 3.0HIGH 8.5
  • TI-2018-01854 Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot… CVSS 3.0HIGH 8.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences