Log in Start free

Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-62290cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

High 7.3

In plain English

A high-severity incorrect authorization in cert-manager from cert-manager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 98.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cert-manager/cert-manager1.19.6GHSA-8rvj-mm4h-c258
Gogithub.com/cert-manager/cert-manager1.20.3GHSA-8rvj-mm4h-c258
Gogithub.com/cert-manager/cert-manager1.19.6, 1.20.3GO-2026-6889

Affected products (as reported)

VendorProductVersions
cert-manager cert-manager >= 1.18.0, < 1.19.6>= 1.20.0, < 1.20.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References