CVE-2025-59823

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0.

• CWE-94

• https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0
• https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6
• https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0
• https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0
• https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0

Published

Sep 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59818This vulnerability allows authenticated attackers to execute…9.8
• CVE-2025-59819This vulnerability allows authenticated attackers to read an…6.5
• CVE-2025-5982An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2025-59820In KDE Krita before 5.2.13, loading a manipulated TGA file c…6.7
• CVE-2025-59821DNN (formerly DotNetNuke) is an open-source web content mana…6.1
• CVE-2025-59822Http4s is a Scala interface for HTTP services. In versions f…7.5
• CVE-2025-59824Omni manages Kubernetes on bare metal, virtual machines, or …5.4
• CVE-2025-59825astral-tokio-tar is a tar archive reading/writing library fo…6.1
• CVE-2025-59826Flag Forge is a Capture The Flag (CTF) platform. In version …7.6
• CVE-2025-59827Flag Forge is a Capture The Flag (CTF) platform. In version …9.8
• CVE-2025-59828Claude Code is an agentic coding tool. Prior to Claude Code …9.8
• CVE-2025-59829Claude Code is an agentic coding tool. Versions below 1.0.12…6.5