---
id: CVE-2026-79767
title: >-
  Gardener implements the automated management and operation of Kubernetes
  clusters as a service
summary: >-
  Gardener implements the automated management and operation of Kubernetes
  clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the
  customverbauthorizer admission plugin's mustCheckProjectMembers manage-members
  check com…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-863
vendor: gardener
product: gardener
affected:
  - gardener < 1.142.6
  - 'gardener >= 1.143.0, < 1.143.3'
  - 'gardener >= 1.144.0, < 1.144.2'
patched:
  - github.com/gardener/gardener 1.142.6
  - gardener/gardener 1.143.3
  - gardener/gardener 1.144.2
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79767'
references:
  - url: >-
      https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545
    label: security-advisories@github.com
  - url: 'https://github.com/gardener/gardener/pull/15080'
    label: security-advisories@github.com
  - url: 'https://github.com/gardener/gardener/releases/tag/v1.144.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gfjv-gqf2-c888'
  - url: 'https://github.com/gardener/gardener'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00389
epssPercentile: 0.30269
aliases:
  - GHSA-gfjv-gqf2-c888
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T14:10:13.169141Z'
ingestedAt: '2026-09-22T20:10:15.095Z'
---

## Overview

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79767)

Affected packages:

- `github.com/gardener/gardener < 1.142.6`
- `gardener/gardener >= 1.143.0, < 1.143.3`
- `gardener/gardener >= 1.144.0, < 1.144.2`

Patched in:

- `github.com/gardener/gardener 1.142.6`
- `gardener/gardener 1.143.3`
- `gardener/gardener 1.144.2`

Source: https://github.com/advisories/GHSA-gfjv-gqf2-c888