Is CVE-2025-67508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67508 being exploited in the wild.

How severe is CVE-2025-67508?

High severity, with a CVSS score of 8.4, published 12 December 2025.

Which products and versions are affected?

github.com/gardener/gardenctl-v2 (Go) SEMVER:introduced=0,fixed=0.0.0-20251107111549-0bdc484cb5fb.

Is there a fix for CVE-2025-67508?

Yes. github.com/gardener/gardenctl-v2 (Go): upgrade to 0.0.0-20251107111549-0bdc484cb5fb or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2025-67508?

Check whether you run github.com/gardener/gardenctl-v2 (Go) or Linuxfoundation Gardenctl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67508: GO-2025-4232 - gardenctl is vulnerable to Command Injection when used with non‑POSIX shells in github.com/gardener/gardenctl-v2

CVE-2025-67508 · Severity: high · CVSS 8.4 · Published 2025-12-12

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators. This issue is fixed in version 2.12.0.

Vendors: Go, Linuxfoundation.

Quick answers

Is CVE-2025-67508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67508 being exploited in the wild.
How severe is CVE-2025-67508?: High severity, with a CVSS score of 8.4, published 12 December 2025.
Which products and versions are affected?: github.com/gardener/gardenctl-v2 (Go) SEMVER:introduced=0,fixed=0.0.0-20251107111549-0bdc484cb5fb.
Is there a fix for CVE-2025-67508?: Yes. github.com/gardener/gardenctl-v2 (Go): upgrade to 0.0.0-20251107111549-0bdc484cb5fb or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-67508?: Check whether you run github.com/gardener/gardenctl-v2 (Go) or Linuxfoundation Gardenctl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gardener/gardenctl-v2 (Go): upgrade to 0.0.0-20251107111549-0bdc484cb5fb or later
```
go get github.com/gardener/gardenctl-v2@v0.0.0-20251107111549-0bdc484cb5fb
```

Affected products

github.com/gardener/gardenctl-v2 (Go) SEMVER:introduced=0,fixed=0.0.0-20251107111549-0bdc484cb5fb
Linuxfoundation Gardenctl

Identifiers

CVE-2025-67508
GHSA-fw33-qpx7-rhx2
GO-2025-4232

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.