8

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67508

CVE-2025-67508: Vulnerability discovered in gardenctl versions < v2.12.0

A security vulnerability was discovered for gardenctl when it is used with non‑POSIX shells such as Fish and PowerShell. Such setup could allow an attacker with administrative privileges for a Gardener project to craft malicious credential values in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators, leading to arbitrary command execution on the operator's device.

Am I vulnerable? This CVE affects all Gardener operators who use gardenctl < v2.12.0 with non‑POSIX shells such as Fish and PowerShell.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67508

CVE-2025-67508:

8

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gardener/gardenctl-v2	go	< 0.0.0-20251107111549-0bdc484cb5fb	0.0.0-20251107111549-0bdc484cb5fb

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the provider-env command of gardenctl, which is used to generate shell scripts for configuring cloud provider CLIs. The root cause was the direct embedding of credential values from Kubernetes Secrets into shell script templates for non-POSIX shells like Fish and PowerShell. An attacker with privileges to modify these secrets could craft a malicious value that breaks out of the intended string context and injects arbitrary commands, leading to command execution on the operator's machine.

The fix was implemented in two main parts across multiple commits, primarily 68fa70c7c7e055e31e0b1b8d69d2bcf8005acb32 and e3e0a83fd478ac42db45b191013269ec1fa8d860:

Schema-Driven Validation: A strict validation framework was introduced for all credential fields. This ensures that values conform to expected formats (e.g., regex for IDs, URI validation for endpoints) and rejects any non-printable or unexpected characters. The legacy GCP-specific parser was replaced with this unified validation mechanism.
Separation of Data and Code: The core of the fix was to stop embedding credential values directly into shell script templates. The generateData function was refactored to write sensitive values to temporary files. The shell templates were updated to read these values from the files, treating them as data rather than executable code. This prevents the shell from interpreting the credential values as commands.

The primary vulnerable functions were generateData and printProviderEnv within the pkg/cmd/providerenv package, which prepared and rendered the unsafe templates. The (*options).Run method is the entry point that triggers this vulnerable workflow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.