Vulnerability · Published Dec 12, 2025 · Assigned by GitHub_M

CVE-2025-67508gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

High 8.0

In plain English

A high-severity command injection in gardenctl-v2 from gardener. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.0High

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/gardener/gardenctl-v2	0.0.0-20251107111549-0bdc484cb5fb	GHSA-fw33-qpx7-rhx2
Go	github.com/gardener/gardenctl-v2	0.0.0-20251107111549-0bdc484cb5fb	GO-2025-4232

Affected products (as reported)

Vendor	Product	Versions
gardener	gardenctl-v2	< 2.12.0

Weakness: CWE-77 · Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/gardener/gardenctl-v2/security/advisories/GHSA-fw33-qpx7-rhx2 x_refsource_CONFIRM