gardener CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM gardener CVE published 2026-09-22

CVE-2026-79767

The Gardener API server's customverbauthorizer admission plugin has an authorization bypass vulnerability. A project admin without manage-members permission can add Group or ServiceAccount subjects, including system:authenticated, to a Project's member list, granting all authenticated users full project-level access. This vulnerability allows project admins to bypass the manage-members custom verb authori [truncated]