CVE-2026-62290

HighCVSS 7.3

Published: 16/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 19/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.08%

0th percentile - higher than 0% of all known CVEs

Summary

A vulnerability in cert-manager allows namespace users to create Challenge resources without admission validation, bypassing DNS01 solver selectors and using ClusterIssuer DNS credentials for attacker-controlled provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. Affects versions from 1.18.0 to 1.19.6 and 1.20.3.

Risk Assessment

The organization is at risk of unauthorized use of ClusterIssuer DNS credentials, potentially leading to leakage of sensitive authentication data and compromise of the certificate issuance process.

Recommendation

Immediately upgrade cert-manager to version 1.19.6 or 1.20.3, which contain the fix for this vulnerability.

Other vulnerabilities in cert-manager

CVE-2024-12401Medium
A flaw was found in the cert-manager package that allows an attacker who can modify PEM data read by cert-manager (e.g., in a Secret resource) to cause high CPU usage in the cert-manager controller pod, leading to a denial-of-service (DoS) vector for cert-manager in the cluster.

Original NVD description (English source)

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.