A command injection vulnerability in Gardener gardenctl-v2 allows attackers with administrative project privileges to execute arbitrary commands within operator shell environments.

This vulnerability is a command injection flaw (CWE-77) triggered when gardenctl evaluates infrastructure Secret objects containing malicious credential strings. It requires the attacker to have administrative privileges for a Gardener project and the operator to be utilizing a non-POSIX shell environment.

The ability for an authenticated attacker to inject and execute arbitrary commands poses a severe risk to the integrity and confidentiality of the Gardener management plane. Given the CVSS score of 8.0, this high-severity flaw could lead to full system compromise of operator workstations or CI/CD pipelines, potentially resulting in unauthorized access to sensitive cloud provider credentials and underlying cluster infrastructure.

Immediate Action: Update gardenctl-v2 to version 2.12.0 or later to neutralize the command injection vulnerability.

Proactive Monitoring: Audit access logs for Gardener projects to identify suspicious changes to infrastructure Secret objects or unusual administrative activity.

Compensating Controls: Restrict the use of non-POSIX shells (Fish and PowerShell) for operators managing Gardener environments until patches are applied, or implement strict input validation policies for all project-level secret configurations.

Public Exploit Available: No.

This vulnerability represents a significant risk to administrative operators within the Gardener ecosystem. Organizations should prioritize updating all instances of gardenctl-v2 to version 2.12.0 immediately to prevent potential command injection attacks. Failure to patch may expose critical cloud infrastructure to unauthorized control by project-level administrators.