{"action":"Upgrade gardener/gardener to 1.143.3 or later.","affected":[{"fixed":"1.143.3","introduced":"1.143.0"},{"fixed":"1.144.2","introduced":"1.144.0"}],"component":"gardener/gardener","cve_ids":["CVE-2026-79767"],"ecosystem":"Go","epss":0.00389,"exploited":false,"fixed_versions":["1.143.3","1.144.2"],"ghsa_id":"GHSA-gfjv-gqf2-c888","id":"tcs_01M5KFAWW4ZYGN84R5GGESZFJ0","modified_at":"2026-10-01T20:55:38.499786900Z","published_at":"2026-09-22T20:40:38Z","references":["https://osv.dev/vulnerability/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-gfjv-gqf2-c888#Go/gardener/gardener","url":"https://osv.dev/vulnerability/GHSA-gfjv-gqf2-c888"}],"summary":"Gardener: Authorization Bypass via Group Subject Injection"}