{"id":"CVE-2026-79767","title":"Gardener implements the automated management and operation of Kubernetes clusters as a service","summary":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check com…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","cwe":["CWE-863"],"vendor":"gardener","product":"github.com/gardener/gardener","affected":["github.com/gardener/gardener < 1.142.6","gardener/gardener >= 1.143.0, < 1.143.3","gardener/gardener >= 1.144.0, < 1.144.2"],"patched":["github.com/gardener/gardener 1.142.6","gardener/gardener 1.143.3","gardener/gardener 1.144.2"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:17:08.957","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79767","references":[{"url":"https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","label":"security-advisories@github.com"},{"url":"https://github.com/gardener/gardener/pull/15080","label":"security-advisories@github.com"},{"url":"https://github.com/gardener/gardener/releases/tag/v1.144.2","label":"security-advisories@github.com"},{"url":"https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-gfjv-gqf2-c888"}],"tags":["nvd","ghsa","go","cve.org"],"aliases":["GHSA-gfjv-gqf2-c888"],"ecosystem":"go","ingestedAt":"2026-09-22T20:10:15.095Z","slug":"CVE-2026-79767","body":"## Overview\n\nGardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-79767)\n\nAffected packages:\n\n- `github.com/gardener/gardener < 1.142.6`\n- `gardener/gardener >= 1.143.0, < 1.143.3`\n- `gardener/gardener >= 1.144.0, < 1.144.2`\n\nPatched in:\n\n- `github.com/gardener/gardener 1.142.6`\n- `gardener/gardener 1.143.3`\n- `gardener/gardener 1.144.2`\n\nSource: https://github.com/advisories/GHSA-gfjv-gqf2-c888","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}