Live › vulnerability › CVE-2026-79767
Go to dashboardGardener's customverbauthorizer admission plugin checks only User subjects when a project member list changes, so a project administrator without manage-members permission can add Group or ServiceAccount subjects, including system:authenticated. The added subjects can reach project Shoots, Secrets and cloud provider credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/gardener/gardener | go | all versions | – |
| github.com/gardener/gardener | go | < 1.142.6 | 1.142.6 |
Unknown from the sources.
Upgrade the gardener/gardener Go module to 1.142.6, 1.143.3, 1.144.2 or 1.145.0 (whichever matches your release line).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-79767")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.