{"uuid": "b3c1e3cd-410d-4a6d-8b5f-be7ba20a0747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79767", "type": "seen", "source": "https://gist.github.com/alon710/26ba9dee42d0a3f388db8a758a47e2b4", "content": "# CVE-2026-79767: CVE-2026-79767: Authorization Bypass in Gardener API Server admission plugin\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79767\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) in Gardener's customverbauthorizer admission plugin allows project administrators lacking the manage-members permission to inject arbitrary Group or ServiceAccount subjects, granting unauthorized access to project resources.\n\n## TL;DR\nGardener's admission plugin failed to compare Group and ServiceAccount subjects during membership updates, enabling restricted project administrators to bypass permission checks and escalate access by injecting arbitrary groups.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.5 (Medium Severity)\n- **EPSS Score**: N/A\n- **Impact**: Privilege Escalation / Authorization Bypass\n- **Exploit Status**: None (No public exploits or active exploitation reported)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Gardener API Server admission plugin (customverbauthorizer)\n- **Gardener**: < 1.142.6 (Fixed in: `1.142.6`)\n- **Gardener**: >= 1.143.0, < 1.143.3 (Fixed in: `1.143.3`)\n- **Gardener**: >= 1.144.0, < 1.144.2 (Fixed in: `1.144.2`)\n- **Gardener**: < 1.145.0 (Fixed in: `1.145.0`)\n\n## Mitigation\n\n- Upgrade Gardener control plane components to a patched release.\n- Run automated audit scripts to search for non-User subjects within project member definitions.\n- Configure API server audit logging to track modification requests targeting the projects custom resource.\n\n**Remediation Steps:**\n1. Identify the current active branch of your Gardener installation (e.g., 1.144.x).\n2. Apply the corresponding patch upgrade (e.g., 1.144.2) to update the Gardener API Server container images.\n3. Verify the update by confirming the customverbauthorizer admission controller is running the patched code.\n4. Execute the provided jq audit script to scan for existing suspicious configurations.\n5. Remove any unauthorized Group or ServiceAccount subjects found during the scan.\n\n## References\n\n- [Gardener Security Advisory](https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888)\n- [Vulnerability Fix Commit](https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545)\n- [Fix Pull Request](https://github.com/gardener/gardener/pull/15080)\n- [Release Tag Info v1.144.2](https://github.com/gardener/gardener/releases/tag/v1.144.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79767) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T03:32:16.983272Z"}