TI-2026-55244 Aliases CVE-2026-79767 GHSA-gfjv-gqf2-c888

Gardener: Authorization Bypass via Group Subject Injection

LOW 25CWE-863Published 2026-09-22 · Updated 2026-09-23

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00389 33rd percentileScored 2026-11-07

Fix Fixed gardener (gardener): 1.142.6, 1.143.3, 1.144.2github.com/gardener/gardener (Go): 1.142.6, 1.143.3, 1.144.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gardener	gardener	before 1.142.6; 1.143.0 to before 1.143.3; 1.144.0 to before 1.144.2	1.142.6, 1.143.3, 1.144.2	Patch available	CNA
—	github.com/gardener/gardener (Go)	before 1.142.6	1.142.6	Patch available	GHSA-gfjv-gqf2-c888
—	github.com/gardener/gardener (Go)	1.143.0 to before 1.143.3	1.143.3	Patch available	GHSA-gfjv-gqf2-c888
—	github.com/gardener/gardener (Go)	1.144.0 to before 1.144.2	1.144.2	Patch available	GHSA-gfjv-gqf2-c888

gardener Vendorgardener Affected before 1.142.6; 1.143.0 to before 1.143.3; 1.144.0 to before 1.144.2 Fixed in 1.142.6, 1.143.3, 1.144.2 Patch available CNA
github.com/gardener/gardener (Go) Vendor— Affected before 1.142.6 Fixed in 1.142.6 Patch available GHSA-gfjv-gqf2-c888
github.com/gardener/gardener (Go) Vendor— Affected 1.143.0 to before 1.143.3 Fixed in 1.143.3 Patch available GHSA-gfjv-gqf2-c888
github.com/gardener/gardener (Go) Vendor— Affected 1.144.0 to before 1.144.2 Fixed in 1.144.2 Patch available GHSA-gfjv-gqf2-c888

Remediation

Fix · CNA gardener (gardener) Fixed in 1.142.6, 1.143.3, 1.144.2
Fix · GHSA-gfjv-gqf2-c888 github.com/gardener/gardener (Go) Fixed in 1.142.6 Advisory →
Fix · GHSA-gfjv-gqf2-c888 github.com/gardener/gardener (Go) Fixed in 1.143.3 Advisory →
Fix · GHSA-gfjv-gqf2-c888 github.com/gardener/gardener (Go) Fixed in 1.144.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-79767
2026-10-03 Alias added: GHSA-gfjv-gqf2-c888
2026-11-04 Fix available: Go/github.com/gardener/[email protected], Go/github.com/gardener/[email protected] · GHSA-gfjv-gqf2-c888
2026-11-04 1 new reference · GHSA-gfjv-gqf2-c888

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-79767

Other 5

TI-2025-29813 Bypassing project secret validation can lead to privilege escalation CVSS 3.1CRITICAL 9.9
TI-2025-29812 Malicious google credential in DNS secret can lead to privilege escalation CVSS 3.0CRITICAL 9.9
TI-2025-37262 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning CVSS 3.0CRITICAL 9.9
TI-2025-29814 Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation CVSS 3.1CRITICAL 9.9
TI-2019-09329 In Gardener before 0.20.0, incorrect access control in seed clusters allows information… CVSS 3.0HIGH 8.5
TI-2018-01854 Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot… CVSS 3.0HIGH 8.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences