{"action":"Upgrade github.com/gardener/gardener to 1.142.6 or later.","affected":[{"fixed":"1.142.6","introduced":"0"}],"component":"github.com/gardener/gardener","cve_ids":["CVE-2026-79767"],"ecosystem":"Go","epss":0.00389,"exploited":false,"fixed_versions":["1.142.6"],"ghsa_id":"GHSA-gfjv-gqf2-c888","id":"tcs_01M5KFAWP572EYWZ2ZK11P0D5R","modified_at":"2026-10-01T20:55:38.499786900Z","published_at":"2026-09-22T20:40:38Z","references":["https://osv.dev/vulnerability/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-gfjv-gqf2-c888","url":"https://osv.dev/vulnerability/GHSA-gfjv-gqf2-c888"}],"summary":"Gardener: Authorization Bypass via Group Subject Injection"}