{"id":"CVE-2026-79767","kind":"vulnerability","aliases":["CVE-2026-79767","GHSA-gfjv-gqf2-c888","GO-2026-6568"],"related":[],"title":"Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","summary":"Gardener's customverbauthorizer admission plugin checks only User subjects when a project member list changes, so a project administrator without manage-members permission can add Group or ServiceAccount subjects, including system:authenticated. The added subjects can reach project Shoots, Secrets and cloud provider credentials.","severity":"medium","cvss":5.5,"epss":0.00389,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/gardener/gardener","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/gardener/gardener","fixed":["1.142.6"],"affected":"< 1.142.6","ecosystem":"go"}],"ecosystems":["go"],"tags":["gardener","go","kubernetes","package"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Upgrade the gardener/gardener Go module to 1.142.6, 1.143.3, 1.144.2 or 1.145.0 (whichever matches your release line).","status":"open","published_at":"2026-09-22T20:17:08+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:48:47+00:00","updated_at":"2026-10-23T21:48:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:48:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the gardener/gardener Go module to 1.142.6, 1.143.3, 1.144.2 or 1.145.0 (whichever matches your release line).\nunknown","reach":"network","impact":"high","summary":"Gardener's customverbauthorizer admission plugin checks only User subjects when a project member list changes, so a project administrator without manage-members permission can add Group or ServiceAccount subjects, including system:authenticated. The added subjects can reach project Shoots, Secrets and cloud provider credentials.","category":"package","who_cares":["gardener","kubernetes","go"],"confidence":0.7,"needs_auth":"yes","worst_case":"Non-admin project member gains broad project access including secrets and cloud credentials","analyst_note":"Confirm from the GHSA-gfjv-gqf2-c888 or GO-2026-6568 advisory how to detect a vulnerable customverbauthorizer setup and whether the plugin is enabled by default; sources conflict on whether all versions are affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000521,"input_tokens":3085,"output_tokens":424,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A,22A '-6568':20A '-79767':12A,23A '/gardener/gardener':26A,29A '1.142.6':94C,169C '1.143.3':95C,170C '1.144.2':96C,171C '1.145.0':98C,173C 'access':151C,154C 'account':117C 'add':59B,68B,135C 'administr':52B,127C 'admiss':37B,101C 'arbitrari':136C 'authent':66B,144C 'author':2A 'autom':82C 'broad':149C 'bypass':3A 'c888':17A 'chang':48B,110C 'check':39B,108C 'cloud':76B,160C 'cluster':88C 'compar':109C 'credenti':78B,162C 'customverbauthor':36B,100C 'cve':10A,21A 'fix':166C 'garden':1A,30B,34B,79C 'gardener/gardener':9A 'gfjv':15A 'ghsa':14A 'ghsa-gfjv-gqf2-c888':13A 'github.com':25A,28A 'github.com/gardener/gardener':24A,27A 'go':18A,31B 'gqf2':16A 'grant':148C 'group':5A,60B,119C,137C,145C 'implement':80C 'includ':64B,141C,156C 'inject':7A 'issu':164C 'kubernet':32B,87C 'lack':129C 'list':47B 'manag':55B,83C,106C,131C 'manage-memb':54B,105C,130C 'member':46B,56B,107C,132C 'mustcheckprojectmemb':104C 'oper':85C 'packag':33B 'permiss':57B,133C 'plugin':38B,102C 'prior':92C 'project':45B,51B,72B,126C,150C 'project.spec.members':124C 'provid':77B,161C 'reach':71B 'result':153C 'secret':74B,158C 'servic':91C 'serviceaccount':62B,121C,139C 'shoot':73B,157C 'subject':6A,42B,63B,69B,113C,122C,140C 'system':65B,143C 'therebi':147C 'user':41B,112C 'version':168C 'via':4A 'without':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T20:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6568","url":"https://pkg.go.dev/vuln/GO-2026-6568","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79767","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79767","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-79767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79767","severity":null,"published_at":"2026-09-22T20:17:08+00:00","modified_at":"2026-09-23T18:12:04+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}