CVE-2025-59823 | Vulnetix

CVE-2025-59823 PUBLISHED CVSS 9.899999618530273 CRITICAL

Record from NVD · Published September 25, 2025

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0.

EPSS 0.49% · 42.4th percentile

Risk scores

CVSS 3.0

9.899999618530273

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.49%

42.4th percentile

Timeline

Sep 25, 2025 CVE Published
Sep 26, 2025 EPSS Score (30 in total, the first dated here)
Oct 4, 2025 Coalition ESS Score (7 in total, the first dated here)
Oct 23, 2025 CVE Updated
Dec 8, 2025 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-59823
vulnetix vdb fixes CVE-2025-59823

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-59823/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →