High severity8.4OSV Advisory· Published Dec 12, 2025· Updated Jun 17, 2026
CVE-2025-67508
CVE-2025-67508
Description
gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/gardener/gardenctl-v2Go | < 0.0.0-20251107111549-0bdc484cb5fb | 0.0.0-20251107111549-0bdc484cb5fb |
Affected products
5- Range: v2.0.0, v2.0.0-rc1, v2.0.0-rc2, …
- ghsa-coords3 versionspkg:golang/github.com/gardener/gardenctl-v2pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.0.0-20251107111549-0bdc484cb5fb+ 2 more
- (no CPE)range: < 0.0.0-20251107111549-0bdc484cb5fb
- (no CPE)range: < 0.0.20251230T014957-150000.1.134.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-fw33-qpx7-rhx2ghsaADVISORY
- github.com/gardener/gardenctl-v2/security/advisories/GHSA-fw33-qpx7-rhx2nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-67508ghsaADVISORY
- pkg.go.dev/vuln/GO-2025-4232ghsaWEB
News mentions
0No linked articles in our index yet.