CVE-2025-67508
HIGH
GHSA-fw33-qpx7-rhx2
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.
Analysis
A command injection vulnerability in gardenctl allows attackers with administrative privileges in a Gardener project to inject malicious commands through crafted credential values when non-POSIX shells (Fish, PowerShell) are used by service operators. The vulnerability affects gardenctl versions 2.11.0 and below, enabling attackers to break out of string contexts and execute arbitrary commands with potentially high impact on confidentiality, integrity, and availability. With an EPSS score of only 0.06% and no known exploitation in the wild or public POC, this represents a lower real-world risk despite the high CVSS score of 8.4.
Technical Context
Gardenctl is a command-line client for the Gardener platform that manages access to Kubernetes clusters and cloud provider CLI tools, identified by CPE cpe:2.3:a:linuxfoundation:gardenctl. The vulnerability stems from improper neutralization of special elements used in OS commands (CWE-77), specifically when credential values from infrastructure Secret objects are evaluated in non-POSIX shell environments like Fish and PowerShell. Unlike POSIX-compliant shells that handle string escaping differently, these shells allow certain characters or sequences in the credential values to break out of their intended string context, enabling command injection when the credentials are processed by Gardener service operators.
Affected Products
The Linux Foundation's gardenctl command-line client versions 2.11.0 and below are affected by this vulnerability, as confirmed by CPE cpe:2.3:a:linuxfoundation:gardenctl:*:*:*:*:*:*:*:* with version constraints. The vulnerability specifically manifests when these versions are used in environments where Gardener service operators utilize non-POSIX shells such as Fish or PowerShell. Details about the vulnerability and affected versions are documented in the official GitHub security advisory at https://github.com/gardener/gardenctl-v2/security/advisories/GHSA-fw33-qpx7-rhx2.
Remediation
Upgrade gardenctl to version 2.12.0 or later, which contains the fix for this command injection vulnerability as detailed in the vendor advisory at https://github.com/gardener/gardenctl-v2/security/advisories/GHSA-fw33-qpx7-rhx2. As an interim mitigation, organizations should audit and restrict administrative access to Gardener projects, ensure service operators use POSIX-compliant shells where possible, and implement monitoring for suspicious credential patterns in infrastructure Secret objects. Additionally, review and validate all existing credentials in Secret objects for potential malicious content before upgrading.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today