Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gardener/gardener | go | < 1.142.6 | 1.142.6 |
| gardener/gardener | go | >= 1.143.0, < 1.143.3 | 1.143.3 |
| gardener/gardener | go | >= 1.144.0, < 1.144.2 | 1.144.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-79767, stems from an authorization bypass in the Gardener API server's customverbauthorizer admission plugin. Specifically, the manage-members custom verb authorization check could be bypassed when adding Group or ServiceAccount subjects to a Project's member list. The core of the issue lies in the isHumanUser function, which was designed to identify 'human users' but only considered subjects of Kind == "User". This meant that Group subjects were not properly accounted for in authorization checks.
When a project admin (without manage-members permission) attempted to add a Group subject, the mustCheckProjectMembers function, which is responsible for comparing old and new member lists, would call findHumanUsersWithRoles. This function, in turn, relied on the flawed isHumanUser function. Since isHumanUser ignored Group subjects, the findHumanUsersWithRoles function would return an incomplete list, making changes to Group members 'invisible' to the authorization check. This allowed an attacker to add arbitrary Group subjects, including system:authenticated, effectively granting all authenticated users full project-level access.
The patch addresses this by replacing isHumanUser with a new function, isServiceAccountSubject, which correctly identifies service accounts (both ServiceAccountKind and UserKind with service account prefixes). The mustCheckProjectMembers and findHumanUsersWithRoles functions were then updated to use this new, correct logic (specifically, findNonServiceAccountsWithRoles which uses the inverse of isServiceAccountSubject). Therefore, the functions customverbauthorizer.isHumanUser, customverbauthorizer.findHumanUsersWithRoles, and customverbauthorizer.mustCheckProjectMembers are identified as vulnerable because they directly contributed to or enabled the authorization bypass in the vulnerable version of the software.
customverbauthorizer.isHumanUserplugin/pkg/global/customverbauthorizer/admission.go
customverbauthorizer.findHumanUsersWithRolesplugin/pkg/global/customverbauthorizer/admission.go
customverbauthorizer.mustCheckProjectMembersplugin/pkg/global/customverbauthorizer/admission.go