cert-manager-controller DoS via Specially Crafted DNS Response
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.
Summary
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cert-manager | cert-manager | 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3 | 1.18.5, 1.19.3 | Patch available | CNA |
| — | github.com/cert-manager/cert-manager (Go) | 1.18.0 to before 1.18.5 | 1.18.5 | Patch available | GHSA-gx3x-vq4p-mhhv |
| — | github.com/cert-manager/cert-manager (Go) | 1.19.0 to before 1.19.3 | 1.19.3 | Patch available | GHSA-gx3x-vq4p-mhhv |
- cert-manager Vendorcert-manager Affected 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3 Fixed in 1.18.5, 1.19.3 Patch available CNA
- github.com/cert-manager/cert-manager (Go) Vendor— Affected 1.18.0 to before 1.18.5 Fixed in 1.18.5 Patch available GHSA-gx3x-vq4p-mhhv
- github.com/cert-manager/cert-manager (Go) Vendor— Affected 1.19.0 to before 1.19.3 Fixed in 1.19.3 Patch available GHSA-gx3x-vq4p-mhhv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cert-manager:cert-manager:*:*:*:*:*:*:*:* | 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3 | Vulnerable | cert-manager |
- cpe:2.3:a:cert-manager:cert-manager:*:*:*:*:*:*:*:* Versions 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3 Vulnerable ·cert-manager
Remediation
- Fix · CNA cert-manager (cert-manager) Fixed in 1.18.5, 1.19.3
- Fix · GHSA-gx3x-vq4p-mhhv github.com/cert-manager/cert-manager (Go) Fixed in 1.18.5 Advisory →
- Fix · GHSA-gx3x-vq4p-mhhv github.com/cert-manager/cert-manager (Go) Fixed in 1.19.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| External Secrets Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Security Profiles Operator | Affected | No fix yet: Fix deferred |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25518
- 2026-10-03 Alias added: GHSA-gx3x-vq4p-mhhv
References
Patch 7
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv
- https://github.com/cert-manager/cert-manager/pull/8467
- https://github.com/cert-manager/cert-manager/pull/8468
- https://github.com/cert-manager/cert-manager/pull/8469
- https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc
- https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d
- https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2
More Cert-manager vulnerabilities
- TI-2024-24306 Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data… CVSS 3.1HIGH 7.2
Sources
- CVE-2026-25518 · CVE Program
- CVE-2026-25518 · NVD
- FIRST EPSS
- GHSA-gx3x-vq4p-mhhv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-25518 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences