https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:16:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-79767 <p>Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin&#39;s mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.</p> <p>Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin&#39;s mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-79767 https://db.gcve.eu/vuln/ghsa-gfjv-gqf2-c888 <p><strong>Affected:</strong> Go: github.com/gardener/gardener, Go: gardener/gardener</p> <p>## Overview The `manage-members` custom verb authorization check in the Gardener API server&#39;s `customverbauthorizer` admission plugin can be bypassed by adding `Group` or `ServiceAccount` subjects to a Project&#39;s member list. The check is documented as controlling &#34;human users or groups&#34;, but the implementation only gates changes to `User`-kind subjects. A project admin (without `manage-members` permission) can add arbitrary Group subjects - including `system:authenticated` - granting all authenticated users full project-level access. ## Technical Details The official Gardener documentation at `docs/usage/project/projects.md:90-92` explicitly states: &lt;img width=&#34;2090&#34; height=&#34;290&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/744f5d6f-1e03-47b5-9dc5-36f20b7e6f4b&#34; /&gt;</p> <p>However, the `mustCheckProjectMembers()` function at `admission.go` compares old and new member lists using `findHumanUsersWithRoles()`, which only tracks subjects where `isHumanUser()` returns true: ```go func mustCheckProjectMembers(oldMembers, members []core.ProjectMember, owner *rbacv1.Subject, userInfo user.Info) bool { if apiequality.Semantic.DeepEqual(oldMembers, members) { return false } if userIsOwner(userInfo, owner) { return false } var oldHumanUsers, newHumanUsers = findHumanUsersWithRoles(oldMembers), findHumanUsersWithRoles(members) // ... return !oldHumanUsers.Equal(newHumanUsers) } ``` The `isHumanUser()` function at `admission.go` only mat…</p> <p><strong>Affected:</strong> Go: github.com/gardener/gardener, Go: gardener/gardener</p> <p>## Overview The `manage-members` custom verb authorization check in the Gardener API server&#39;s `customverbauthorizer` admission plugin can be bypassed by adding `Group` or `ServiceAccount` subjects to a Project&#39;s member list. The check is documented as controlling &#34;human users or groups&#34;, but the implementation only gates changes to `User`-kind subjects. A project admin (without `manage-members` permission) can add arbitrary Group subjects - including `system:authenticated` - granting all authenticated users full project-level access. ## Technical Details The official Gardener documentation at `docs/usage/project/projects.md:90-92` explicitly states: &lt;img width=&#34;2090&#34; height=&#34;290&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/744f5d6f-1e03-47b5-9dc5-36f20b7e6f4b&#34; /&gt;</p> <p>However, the `mustCheckProjectMembers()` function at `admission.go` compares old and new member lists using `findHumanUsersWithRoles()`, which only tracks subjects where `isHumanUser()` returns true: ```go func mustCheckProjectMembers(oldMembers, members []core.ProjectMember, owner *rbacv1.Subject, userInfo user.Info) bool { if apiequality.Semantic.DeepEqual(oldMembers, members) { return false } if userIsOwner(userInfo, owner) { return false } var oldHumanUsers, newHumanUsers = findHumanUsersWithRoles(oldMembers), findHumanUsersWithRoles(members) // ... return !oldHumanUsers.Equal(newHumanUsers) } ``` The `isHumanUser()` function at `admission.go` only mat…</p> https://db.gcve.eu/vuln/ghsa-gfjv-gqf2-c888