CVE-2026-79767— Gardener: Authorization Bypass via Group Subject Injection
Quick assessment
Affected
gardener gardener
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User s
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79767
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gardener: Authorization Bypass via Group Subject Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-79767
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79767
请登录查看更多情报信息。
Other References for CVE-2026-79767 (4)
-
https://github.com/gardener/gardener/pull/15080 x_refsource_MISC
-
https://github.com/gardener/gardener/releases/tag/v1.144.2 x_refsource_MISC
-
https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: gardener
-
CVE-2025-67508
gardenctl is vulnerable to Command Injection when used with -
CVE-2025-59823
Gardener providers vulnerable to code injection when Terrafo -
CVE-2025-47284
Gardener vulnerable to metadata injection for a project secr -
CVE-2025-47283
Bypassing project secret validation can lead to privilege es -
CVE-2025-47282
Malicious google credential in DNS secret can lead to privil
Same weakness: CWE-863
-
CVE-2026-95814
Vaultwarden through 1.37.3 Authorization Bypass via Missing -
CVE-2026-75745
Adobe Experience Manager Forms JEE | Incorrect Authorization -
CVE-2026-75723
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75728
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75608
Frigate: Viewer-Role User Can Access go2rtc Internal API to
V. Comments for CVE-2026-79767
No comments yet