Quick answers
- Is CVE-2026-119115 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-119115 being exploited in the wild.
- How severe is CVE-2026-119115?
- High severity, with a CVSS score of 8.5, published 29 October 2026.
- Which products and versions are affected?
- Aws-Privateca-Issuer before v1.10.1; AWS Private CA Connector for Kubernetes before v1.10.1.
- Is there a fix for CVE-2026-119115?
- Yes: fixed in aws-privateca-issuer v1.10.1, AWS Private CA Connector for Kubernetes EKS add-on v1.10.1-eksbuild.1. Until then: If immediate upgrade is not possible, scope certificate approval policies and RBAC rules to both the issuer name and issuer kind. Before upgrading, audit CertificateRequest, Certificate, and Ingress resources to ensure issuerRef.kind is explicitly set to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-119115 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-119115?
- Check whether you run Amazon AWS, Aws-Privateca-Issuer or AWS Private CA Connector for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: aws-privateca-issuer v1.10.1, AWS Private CA Connector for Kubernetes EKS add-on v1.10.1-eksbuild.1
If immediate upgrade is not possible, scope certificate approval policies and RBAC rules to both the issuer name and issuer kind. Before upgrading, audit CertificateRequest, Certificate, and Ingress resources to ensure issuerRef.kind is explicitly set to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).
Technical details
An incorrect authorization vulnerability in issuer resolution allows authenticated users with namespace-scoped issuer access to obtain certificates, including subordinate CA certificates, signed by cluster-scoped issuers they are not authorized to use. The vulnerability occurs when the issuer resolution logic fails to properly validate the issuerRef.kind against the actual issuer scope. Remediation requires upgrading and auditing certificate request resources to explicitly specify matching issuer kinds.
Affected products
- AWS Private CA Connector for Kubernetes before v1.10.1
- AWS aws-privateca-issuer before v1.10.1
Timeline
- 2026-10-29: disclosed: CVE-2026-119115 disclosed in AWS Security Bulletin
- 2026-10-29: patched: Fixed in v1.10.1 and v1.10.1-eksbuild.1