CVE-2026-62290: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
Vulnerability summary
CVE-2026-62290 is a high (CVSS 7.3) Incorrect Authorization vulnerability in cert-manager. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 16-07-2026PublishedVulnerability first disclosed.
- 18-07-2026Last modifiedVulnerability information updated.
Description
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- OSV · GoEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.11% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCert Manager
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard43 products
- athenz-cert-manager-issuer< 0.0.8-r3
- athenz-cert-manager-issuer-fips< 0.0.8-r4
- athenz-csi-driver< 0.0.15-r2
- athenz-csi-driver-approver< 0.0.15-r2
- athenz-csi-driver-fips< 0.0.15-r4
Wolfi10 products
- aws-privateca-issuer< 1.9.0-r4
- cert-manager-cmctl< 2.5.0-r12
- cert-manager-csi-driver< 0.15.0-r9
- cert-manager-istio-csr< 0.16.0-r18
- cert-manager-webhook-pdns< 2.5.5-r17
Cert-manager1 product
- cert-manager≥ 1.18.0, < 1.19.6 | ≥ 1.20.0, < 1.20.3
Github.com/cert-manager1 product
- cert-manager≥ 1.18.0, < 1.19.6 | ≥ 1.20.0-alpha.0, < 1.20.3
Linuxfoundation1 product
- cert-manager≥ 1.18.0, < 1.19.6 | ≥ 1.20.0, < 1.20.3
5 vendors · 56 products
References
10 links- github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258X Refsource CONFIRMAdvisoryExploitMitigationVendor AdvisoryWEB
- github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155X Refsource MISCFIXPatchWEB
- github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16X Refsource MISCFIXPatchWEB
