Junglewise Threat Intelligence

CVE-2026-62290: cert-manager authorization bypass in Challenge resource creation

CVE-2026-62290 · Severity: high · CVSS 7.3 · Published 2026-07-16

Executive brief

cert-manager is a tool used to automate the management and issuance of TLS certificates in Kubernetes environments. A security flaw allows users with limited access to a specific namespace to bypass security restrictions and use high-level administrative credentials to issue certificates for domains they do not own. This could lead to the unauthorized issuance of certificates and the exposure of sensitive API keys used for DNS management.

Technical details

An authorization bypass vulnerability exists in cert-manager due to incorrect RBAC permissions in the 'cert-manager-edit' aggregate ClusterRole. Between versions 1.18.0 and 1.20.3, namespace users could directly create 'Challenge' resources under 'acme.cert-manager.io' without proper admission validation. By crafting a Challenge resource with a malicious 'spec.solver' value referencing a 'ClusterIssuer', an attacker can bypass DNS01 selectors (such as dnsZones or matchLabels). This allows the attacker to force cert-manager to use administrative DNS credentials for unauthorized domains, potentially disclosing sensitive 'X-Api-User' and 'X-Api-Key' headers for acme-dns. The fix involves removing 'create' permissions for Challenges and 'create/patch/update' permissions for Orders from the aggregate edit role.

Affected products

  • cert-manager cert-manager >= 1.18.0, < 1.19.6; >= 1.20.0, < 1.20.3

Timeline

  • 2026-06-25: patched: Fixes merged into release branches 1.19 and 1.20
  • 2026-07-16: advisory: CVE-2026-62290 published

References

Related threats