CVE-2026-79767: Gardener Kubernetes Privilege Escalation

CVE-2026-79767 Overview

Gardener is an open-source project that automates the management and operation of Kubernetes clusters as a service. CVE-2026-79767 is an authorization flaw [CWE-863] in the customverbauthorizer admission plugin. The mustCheckProjectMembers manage-members check only compares changes to User subjects and ignores Group and ServiceAccount subjects in Project.spec.members. A project administrator without the manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and grant broad project access. The issue is fixed in Gardener versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

Critical Impact
A project administrator lacking manage-members rights can grant unauthorized access to Shoots, Secrets, and cloud provider credentials by adding Group or ServiceAccount subjects, including system:authenticated.

Affected Products

Gardener versions prior to 1.142.6 (1.142.x branch)
Gardener versions prior to 1.143.3 (1.143.x branch)
Gardener versions prior to 1.144.2 (1.144.x branch) and prior to 1.145.0

Discovery Timeline

2026-09-22 - CVE-2026-79767 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-79767

Vulnerability Analysis

Gardener enforces the manage-members permission through the customverbauthorizer admission plugin. When a Project resource is updated, the plugin calls mustCheckProjectMembers to determine whether the caller is modifying membership. The check compared only User subjects between the old and new member lists. Changes to Group and ServiceAccount entries produced no diff, so the admission plugin skipped the authorization check entirely.

An attacker with project-admin rights but no manage-members permission can exploit this gap. By adding a broad Group such as system:authenticated or an attacker-controlled ServiceAccount to Project.spec.members, the attacker extends role bindings to identities they should not be able to authorize. The resulting access covers Shoot resources, project Secrets, and cloud provider credentials tied to the project.

Root Cause

The root cause is incomplete subject handling in the admission plugin located at plugin/pkg/global/customverbauthorizer/admission.go. The helper findHumanUsersWithRoles and its supporting types operated only on human User subjects, mirroring an assumption that only users needed authorization checks. RBAC subjects in Kubernetes include User, Group, and ServiceAccount, and Gardener projects accept all three. The mismatch between the RBAC subject model and the plugin's diff logic produced the missing authorization check [CWE-863].

Attack Vector

Exploitation requires authenticated access with project-admin rights on a target Gardener project. The attacker issues a standard Kubernetes update to the Project object and appends a new member with kind: Group or kind: ServiceAccount. The admission plugin allows the change without verifying the manage-members verb. Any identity matching the added subject then inherits the associated project role.

 		return false
 	}
 
-	var oldHumanUsers, newHumanUsers = findHumanUsersWithRoles(oldMembers), findHumanUsersWithRoles(members)
+	var oldNonServiceAccounts, newNonServiceAccounts = findNonServiceAccountsWithRoles(oldMembers), findNonServiceAccountsWithRoles(members)
 	// Remove owner subject from `members` list to always allow it to be added
-	if owner != nil && isHumanUser(*owner) {
-		ownerKey := humanMemberKey(*owner)
-		removeEntriesWithMember(oldHumanUsers, ownerKey)
-		removeEntriesWithMember(newHumanUsers, ownerKey)
+	if owner != nil && !isServiceAccountSubject(*owner) {
+		ownerKey := memberSubjectKey(*owner)
+		removeEntriesWithMember(oldNonServiceAccounts, ownerKey)
+		removeEntriesWithMember(newNonServiceAccounts, ownerKey)
 	}
 
-	return !oldHumanUsers.Equal(newHumanUsers)
+	return !oldNonServiceAccounts.Equal(newNonServiceAccounts)
 }

Source: Gardener commit 63751db. The patch replaces findHumanUsersWithRoles with findNonServiceAccountsWithRoles and treats any non-ServiceAccount subject uniformly, aligning the diff with the full RBAC subject model.

Detection Methods for CVE-2026-79767

Indicators of Compromise

Audit log entries showing update or patch operations on projects.core.gardener.cloud where new entries appear in spec.members with kind: Group or kind: ServiceAccount.
Presence of the system:authenticated Group as a project member, especially in projects that previously restricted access to named users.
Unexpected access to project Shoots, Secrets, or cloud provider credential resources from identities not previously bound to the project.

Detection Strategies

Compare historical snapshots of Project.spec.members against current state and alert on additions of Group or ServiceAccount subjects.
Correlate Project update events with the caller's RBAC verbs to identify updates performed by principals lacking the manage-members verb.
Review Gardener API server audit logs for Project mutations from users assigned the project-admin role but not the manage-members role.

Monitoring Recommendations

Enable Kubernetes API server audit logging at the RequestResponse level for the core.gardener.cloud API group.
Forward Gardener control-plane audit logs to a centralized data lake and build detections for membership drift on Project objects.
Alert on any project membership containing broad Groups such as system:authenticated, system:unauthenticated, or system:serviceaccounts.

How to Mitigate CVE-2026-79767

Immediate Actions Required

Upgrade Gardener to a fixed release: 1.142.6, 1.143.3, 1.144.2, or 1.145.0 or later.
Audit every Project resource for Group and ServiceAccount entries in spec.members and remove any that were not authorized.
Rotate cloud provider credentials and project Secrets for any project where unauthorized membership changes are suspected.
Review project-admin role assignments and revoke access for principals that do not require it.

Patch Information

The fix is delivered in Gardener releases 1.142.6, 1.143.3, 1.144.2, and 1.145.0. The corrective change is tracked in GitHub Pull Request #15080 and applied by commit 63751db. Full advisory details are published as GHSA-gfjv-gqf2-c888 and the release notes are available at Gardener v1.144.2.

Workarounds

Restrict the project-admin role to trusted operators until the upgrade is applied.
Add an external admission webhook that rejects updates to Project.spec.members when the caller lacks the manage-members verb, covering Group and ServiceAccount subjects.
Enforce policy engines such as Kyverno or OPA Gatekeeper to deny addition of broad Groups like system:authenticated to any Project object.

bash

# Verify installed Gardener version and confirm it is a fixed release
kubectl -n garden get deployment gardener-apiserver \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

# List all projects with Group or ServiceAccount members for review
kubectl get projects.core.gardener.cloud -o json | \
  jq '.items[] | {name: .metadata.name, members: [.spec.members[] | select(.kind=="Group" or .kind=="ServiceAccount")]}'