{"id":"EUVD-2026-84821","enisaUuid":"2d2de8ea-5d43-3619-9443-7343d3f7ffb7","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin\u0027s mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","datePublished":"Sep 22, 2026, 7:58:00 PM","dateUpdated":"Sep 23, 2026, 2:36:18 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888\nhttps://github.com/gardener/gardener/pull/15080\nhttps://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545\nhttps://github.com/gardener/gardener/releases/tag/v1.144.2\n","aliases":"CVE-2026-79767\nGHSA-gfjv-gqf2-c888\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"039a8883-be50-3681-b944-f102c856bd49","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"1.143.0, \u003c 1.143.3"},{"id":"8bb06cbb-b123-3e76-b908-928d4a0c9dee","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"\u003c 1.142.6"},{"id":"d9207f94-88e6-3cee-81fb-b5ed66dc53c0","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"1.144.0, \u003c 1.144.2"}],"enisaIdVendor":[{"id":"04617b90-29f2-32e7-ade7-0a528cf19ab1","vendor":{"name":"gardener"}}],"enisaIdVulnerability":[{"id":"5bb39cea-f261-3d16-aba7-a85de6cb2a71","vulnerability":{"id":"CVE-2026-79767","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin\u0027s mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","datePublished":"Sep 22, 2026, 7:58:00 PM","dateUpdated":"Sep 23, 2026, 2:36:18 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888\nhttps://github.com/gardener/gardener/pull/15080\nhttps://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545\nhttps://github.com/gardener/gardener/releases/tag/v1.144.2\n","enisa_id":"EUVD-2026-84821\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 11, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"89d0e476-196a-3cfb-b278-309d6976b00e","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"\u003c 1.142.6"},{"id":"9c07160f-8a05-373c-b06f-d1371afa0ed8","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"1.143.0, \u003c 1.143.3"},{"id":"cff8a64d-6568-397c-bca9-c73fe60f872a","product":{"name":"gardener","vendor":{"name":"gardener"}},"product_version":"1.144.0, \u003c 1.144.2"}],"vulnerabilityVendor":[{"id":"fbf93692-f272-3a6b-a6f5-7137ec5eb880","vendor":{"name":"gardener"}}]}},{"id":"8113793a-14c9-3654-b396-79dbd5c8318f","vulnerability":{"id":"GHSA-gfjv-gqf2-c888","description":"Gardener: Authorization Bypass via Group Subject Injection","datePublished":"Sep 22, 2026, 8:40:38 PM","dateUpdated":"Nov 4, 2026, 11:15:31 PM","baseScore":0.0,"references":"https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79767\nhttps://github.com/gardener/gardener/pull/15080\nhttps://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545\nhttps://github.com/gardener/gardener\nhttps://github.com/gardener/gardener/releases/tag/v1.144.2\n","enisa_id":"EUVD-2026-84821\n","aliases":"GHSA-gfjv-gqf2-c888\nCVE-2026-79767\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}