Read the docs
TI-2026-44479 Aliases CVE-2026-62290GHSA-8rvj-mm4h-c258

Incorrect authorization in cert-manager

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00112 1st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cert-manager (cert-manager): 1.19.6, 1.20.3github.com/cert-manager/cert-manager (Go): 1.19.6, 1.20.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cert-managercert-manager1.18.0 to before 1.19.6; 1.20.0 to before 1.20.31.19.6, 1.20.3Patch availableCNA
—github.com/cert-manager/cert-manager (Go)1.18.0 to before 1.19.61.19.6Patch availableGHSA-8rvj-mm4h-c258
—github.com/cert-manager/cert-manager (Go)1.20.0-alpha.0 to before 1.20.31.20.3Patch availableGHSA-8rvj-mm4h-c258
  • cert-manager Vendorcert-manager Affected 1.18.0 to before 1.19.6; 1.20.0 to before 1.20.3 Fixed in 1.19.6, 1.20.3 Patch available CNA
  • github.com/cert-manager/cert-manager (Go) Vendor— Affected 1.18.0 to before 1.19.6 Fixed in 1.19.6 Patch available GHSA-8rvj-mm4h-c258
  • github.com/cert-manager/cert-manager (Go) Vendor— Affected 1.20.0-alpha.0 to before 1.20.3 Fixed in 1.20.3 Patch available GHSA-8rvj-mm4h-c258

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:cert-manager:*:*:*:*:*:*:*:*1.18.0 to before 1.19.6; 1.20.0 to before 1.20.3Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:cert-manager:*:*:*:*:*:*:*:* Versions 1.18.0 to before 1.19.6; 1.20.0 to before 1.20.3 Vulnerable ·backstage

Remediation

  • Fix · CNA cert-manager (cert-manager) Fixed in 1.19.6, 1.20.3
  • Fix · GHSA-8rvj-mm4h-c258 github.com/cert-manager/cert-manager (Go) Fixed in 1.19.6 Advisory →
  • Fix · GHSA-8rvj-mm4h-c258 github.com/cert-manager/cert-manager (Go) Fixed in 1.20.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62290
  2. 2026-10-29 Alias added: GHSA-8rvj-mm4h-c258
  3. 2026-10-29 Fix available: Go/github.com/cert-manager/[email protected], Go/github.com/cert-manager/[email protected] · GHSA-8rvj-mm4h-c258
  4. 2026-10-29 CVSS score added · GHSA-8rvj-mm4h-c258
  5. 2026-10-29 Weakness changed · GHSA-8rvj-mm4h-c258
  6. 2026-10-29 9 new references · GHSA-8rvj-mm4h-c258
  7. 2026-11-06 Affected versions changed · Red Hat
  8. 2026-11-06 CVSS score added · Red Hat
  9. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Patch 4

Advisory 1

Other 3

  • TI-2024-24306 Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data… CVSS 3.1HIGH 7.2
  • TI-2026-20627 cert-manager-controller DoS via Specially Crafted DNS Response CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences