CVE-2025-59823: Code Injection in Gardener Extension Provider AWS

The code injection vulnerability in gardener.com/gardener-extension-provider-aws poses a significant threat. An attacker who can influence the Terraform provisioning process can inject arbitrary code into the infrastructure being created. This could lead to complete system compromise, including unauthorized access to sensitive data, modification of system configurations, and the potential for lateral movement within the Gardener cluster. The impact is particularly severe because Terraform is often used for automated infrastructure deployment, making it a prime target for attackers seeking to gain control over the entire environment. Successful exploitation could allow an attacker to establish a persistent foothold and exfiltrate sensitive information.

1. Reserved2025-09-22
2. Published2025-10-23
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59823 is to immediately upgrade to version 1.64.0 or later of gardener.com/gardener-extension-provider-aws. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing stricter input validation and sanitization within your Terraform configurations to prevent malicious code from being injected. Review and audit all Terraform templates and scripts used for infrastructure provisioning. Additionally, restrict access to Terraform state files to prevent unauthorized modifications. After upgrading, verify the fix by attempting to trigger a Terraform provisioning process with a known malicious payload and confirming that it is properly sanitized and rejected.