{"action":"Upgrade github.com/gardener/gardener to 1.142.6 or later.","affected":[{"introduced":"0"},{"fixed":"1.142.6","introduced":"0"}],"component":"github.com/gardener/gardener","cve_ids":["CVE-2026-79767"],"ecosystem":"Go","epss":0.00389,"exploited":false,"fixed_versions":["1.142.6"],"ghsa_id":"GHSA-gfjv-gqf2-c888","id":"tcs_01M5KGVEMF8PV4T3MJKXFA35Q8","modified_at":"2026-10-01T20:45:13.175814132Z","published_at":"2026-10-01T20:23:38Z","references":["https://osv.dev/vulnerability/GO-2026-6568","https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6568","url":"https://osv.dev/vulnerability/GO-2026-6568"}],"summary":"Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener"}