Gardener provider extensions: code injection via Terraformer lets a project admin take over the seed cluster

Impact

A user who only holds administrative rights inside a single Gardener project can inject code into the Terraformer run that provisions that shoot's infrastructure, and from there gain control of the seed cluster that manages it. The seed hosts the control planes of every shoot assigned to it, so this is a tenant-to-operator escape: one project owner reaches the credentials, kubeconfigs and control-plane workloads of unrelated clusters on the same seed. For a GPU cloud that hands each customer their own Gardener project, that is the full multi-tenancy boundary. The flaw spans the AWS, Azure, GCP and OpenStack provider extensions and applies to any installation where Terraformer is used or can be enabled.

Who can reach it

Authenticated, with administrative privileges on a Gardener project (a normal tenant role in a managed-Kubernetes offering). No access to the seed cluster or to the management network is needed.

What to do

Upgrade the affected provider extensions: AWS to 1.64.0, Azure to 1.55.0, GCP to 1.46.0, OpenStack to 1.49.0. This is a controller image bump in the garden/seed cluster - the extension pods restart and reconcile; no worker node drain or reboot is involved. Where an upgrade cannot be scheduled immediately, review whether Terraformer-based provisioning can be disabled for the affected providers and audit project-admin grants.

References

Related entries

• StreamsHub Console operator: tenant-supplied container image runs with a cluster-wide Strimzi ServiceAccountCVE-2026-105312 · StreamsHub Console for Apache Kafka (Console CR operator, image field)Critical
• Argo CD repo-server: Jsonnet imports escape the repository root and read service-account tokensCVE-2026-113672 · Argo CD argocd-repo-server (Jsonnet import path confinement)Critical
• Argo CD repo-server: Kustomize ref value injects git --upload-pack and runs commands in the podCVE-2026-113708 · Argo CD argocd-repo-server (Kustomize remote ref passed to git fetch)Critical
• Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes itCVE-2026-113709 · Argo CD argocd-repo-server (Kustomize helmGlobals.configHome plugin loading)Critical
• Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted clusterCVE-2026-41050 · Rancher Fleet Helm deployer (ServiceAccount impersonation)Critical
• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical