CVE-2026-79767 in Gardener
Summary
by MITRE • 09/22/2026
Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
Gardener serves as a critical infrastructure for the automated management and operation of Kubernetes clusters delivered as a service, enabling organizations to maintain consistent control planes across diverse cloud environments. Within this architecture, access control is governed by admission plugins that enforce authorization policies before API requests are processed. A significant flaw was identified in the customverbauthorizer admission plugin, specifically within its logic for managing project membership permissions prior to versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0. The vulnerability stems from an incomplete implementation of the mustCheckProjectMembers function, which is designed to validate whether a user has the necessary permissions to modify project membership lists.
The core technical flaw lies in the scope of subject validation performed during these checks. While the system correctly verifies changes made to User subjects against the manage-members permission requirement, it fails to apply similar scrutiny to Group or ServiceAccount subjects within Project.spec.members. This oversight creates a logic bypass where an actor with limited privileges can exploit this gap. Specifically, if a project administrator lacks the explicit manage-members permission but possesses other sufficient permissions for their role, they are able to append arbitrary Group or ServiceAccount entries to the project membership list without triggering the expected authorization denial.
By exploiting this deficiency, an attacker can add high-privilege subjects such as the system:authenticated group or specific service accounts that possess elevated rights within the cluster. This action effectively grants these broad-scope identities access to resources restricted to authorized members only. The operational impact is severe because it allows unauthorized entities to interact with sensitive project assets. Once added, these maliciously injected subjects can access critical components including Shoots, which represent managed Kubernetes clusters; Secrets containing application data or configuration details; and cloud provider credentials that provide direct infrastructure control.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it allows a lower-privileged user to escalate their effective privileges by manipulating authorization structures. Furthermore, the exploitation technique corresponds to ATT&CK T1078, Valid Accounts, and potentially T1548, Abuse Elevation Control Mechanism, since the attacker abuses the legitimate membership management feature to bypass intended access controls. The ability to inject system:authenticated groups is particularly dangerous as it may grant access to any authenticated user depending on how those group permissions are configured in the broader RBAC policy.
To mitigate this risk and prevent unauthorized privilege escalation through project member manipulation, organizations must upgrade Gardener to version 1.142.6 or later for the 1.142.x branch, 1.143.3 for the 1.143.x branch, 1.144.2 for the 1.144.x branch, and 1.145.0 or later for the 1.145.x branch. These updated releases correct the validation logic in the customverbauthorizer to ensure that all subject types, including Groups and ServiceAccounts, are properly checked against the manage-members permission requirement before being added to project membership lists. Until such upgrades are applied, administrators should closely monitor Project.spec.members for unexpected additions of system groups or service accounts and restrict who holds administrative privileges within Gardener projects.