DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-79767: CVE-2026-79767: Authorization Bypass in Gardener API Server admission plugin

#security #cve #cybersecurity

CVE-2026-79767: Authorization Bypass in Gardener API Server admission plugin

Vulnerability ID: CVE-2026-79767
CVSS Score: 5.5
Published: 2026-09-22

An incorrect authorization vulnerability (CWE-863) in Gardener's customverbauthorizer admission plugin allows project administrators lacking the manage-members permission to inject arbitrary Group or ServiceAccount subjects, granting unauthorized access to project resources.

TL;DR

Gardener's admission plugin failed to compare Group and ServiceAccount subjects during membership updates, enabling restricted project administrators to bypass permission checks and escalate access by injecting arbitrary groups.

Technical Details

  • CWE ID: CWE-863 (Incorrect Authorization)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.5 (Medium Severity)
  • EPSS Score: N/A
  • Impact: Privilege Escalation / Authorization Bypass
  • Exploit Status: None (No public exploits or active exploitation reported)
  • KEV Status: Not Listed in CISA KEV

Affected Systems

  • Gardener API Server admission plugin (customverbauthorizer)
  • Gardener: < 1.142.6 (Fixed in: 1.142.6)
  • Gardener: >= 1.143.0, < 1.143.3 (Fixed in: 1.143.3)
  • Gardener: >= 1.144.0, < 1.144.2 (Fixed in: 1.144.2)
  • Gardener: < 1.145.0 (Fixed in: 1.145.0)

Code Analysis

Commit: 63751db

Refined project membership check logic to inspect non-service account subjects instead of filtering for only human users.

Mitigation Strategies

  • Upgrade Gardener control plane components to a patched release.
  • Run automated audit scripts to search for non-User subjects within project member definitions.
  • Configure API server audit logging to track modification requests targeting the projects custom resource.

Remediation Steps:

  1. Identify the current active branch of your Gardener installation (e.g., 1.144.x).
  2. Apply the corresponding patch upgrade (e.g., 1.144.2) to update the Gardener API Server container images.
  3. Verify the update by confirming the customverbauthorizer admission controller is running the patched code.
  4. Execute the provided jq audit script to scan for existing suspicious configurations.
  5. Remove any unauthorized Group or ServiceAccount subjects found during the scan.

References

Read the full report for CVE-2026-79767 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)