Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-79767Gardener: Authorization Bypass via Group Subject Injection

Medium 5.5

In plain English

A medium-severity incorrect authorization in gardener from gardener. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/gardener/gardener1.142.6GHSA-gfjv-gqf2-c888
Gogithub.com/gardener/gardener1.143.3GHSA-gfjv-gqf2-c888
Gogithub.com/gardener/gardener1.144.2GHSA-gfjv-gqf2-c888
Gogithub.com/gardener/gardenerno fix listedGO-2026-6568
Gogithub.com/gardener/gardener1.142.6GO-2026-6568

Affected products (as reported)

VendorProductVersions
gardener gardener < 1.142.6>= 1.143.0, < 1.143.3>= 1.144.0, < 1.144.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

References