CVE-2026-79767 gardener CVE debrief

Who should care

Defenders responsible for Gardener deployments, especially those with project admins who can modify member lists, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability in their Gardener deployments.

Why it matters

The Gardener authorization bypass vulnerability allows project admins to grant all authenticated users full project-level access, potentially leading to unauthorized access and project compromise. Defenders should prioritize verifying and remediating this vulnerability in their Gardener deployments.

• Potential unauthorized access to project resources
• Elevation of privileges for authenticated users
• Increased risk of project compromise
• Need for verification of Gardener deployment versions and patching

Technical summary

The Gardener API server's customverbauthorizer admission plugin has an authorization bypass vulnerability. The manage-members custom verb authorization check can be bypassed by adding Group or ServiceAccount subjects to a Project's member list. This allows project admins without manage-members permission to grant all authenticated users full project-level access. The vulnerability arises from the implementation of the mustCheckProjectMembers() function, which only tracks subjects where isHumanUser() returns true. The official Gardener documentation explicitly states that the check controls 'human users or groups', but the implementation only gates changes to User-kind subjects.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Gardener deployments, especially those with project admins who can modify member lists.

Recommended defensive actions

• Verify Gardener deployment versions and apply patches or updates to remediate the vulnerability
• Restrict project admin permissions to prevent unauthorized member list modifications
• Monitor project member lists for suspicious changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is documented in the official Gardener documentation and source code. The issue arises from the implementation of the mustCheckProjectMembers() function, which only tracks subjects where isHumanUser() returns true.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.