ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-62290

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

Published Jul 16, 2026 · catalog updated Oct 29, 2026 · cert-manager: Direct ACME Challenge

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-62290. EPSS is 0.11%. Act only if a listed version of cert-manager: Direct ACME Challenge is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (cert-manager: Direct ACME Challenge).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.11%
Remediation
Version ranges on file
Affected products
Go github.com/cert-manager/cert-manager · go github.com/cert-manager/cert-manager · golang github.com · vendor cert-manager cert-manager

## Summary resources under can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an , an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses as the DNS01 provider configuration. When the direct Challenge references a , cert-manager derives the DNS provider secret namespace and ambient-credential policy from the reference, but the DNS provider configuration itself is attacker-controlled through . This lets a namespace user bypass / solver selectors such as , , and , and make the cert-manager controller use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names. In the acme-dns case, this becomes credential disclosure because the attacker-controlled solver host receives the and headers loaded by cert-manager from the ClusterIssuer resource namespace. ## Attack preconditions - The attacker can create resources in at least one namespace. - The cert-manager controller is running and reconciles ACME resources cluster-wide. - A usable exists in the cluster. - The referenced has a DNS01 solver that uses a Secret in the cluster resource namespace, or relies on ambient credentials enabled for . - The cluster is multi-tenant or otherwise separates namespace users from platform-owned Issuer/ClusterIssuer and DNS credential administration. ## Severity Rationale: a tenant with namespace-level ACME Challenge create permissions, including permissions granted by cert-manager's aggregate edit role, can cause a cluster-scoped controller to use DNS credentials or ambient cloud credentials outside the Issuer's intended solver policy. With acme-dns specifically, this can disclose the referenced acme-dns account credential to an attacker-controlled endpoint. With other DNS providers, the impact is credential use, Issuer policy bypass, and unauthorized DNS mutation risk unless a provider-specific credential disclosure path

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/cert-manager/cert-manager1.18.0 → 1.19.6
  • Go github.com/cert-manager/cert-manager1.20.0-alpha.0 → 1.20.3
  • go github.com/cert-manager/cert-manager>= 1.18.0, < 1.19.6
  • go github.com/cert-manager/cert-manager>= 1.20.0-alpha.0, < 1.20.3
  • go github.com/cert-manager/cert-manager>=1.18.0 <1.19.6||>=1.20.0-alpha.0 <1.20.3
  • golang github.comversion unspecified
  • vendor cert-manager cert-managerversion unspecified

How to fix CVE-2026-62290

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-62290. EPSS is 0.11%. Act only if a listed version of cert-manager: Direct ACME Challenge is installed.

Which versions are affected?

Compare what you have installed with 1.18.0 → 1.19.6, 1.20.0-alpha.0 → 1.20.3, >= 1.18.0, < 1.19.6, >= 1.20.0-alpha.0, < 1.20.3, >=1.18.0 <1.19.6||>=1.20.0-alpha.0 <1.20.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.11%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · Go Vulnerability Database

    Detected

    ## Summary resources under can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an , an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses as the DNS01 provider configuration. When the direct Challenge references a , cert-manager derives the DNS provider sec

  2. Oct 29, 2026 · Go Vulnerability Database

    Fix available

    github.com/cert-manager/cert-manager fixed in 1.19.6; github.com/cert-manager/cert-manager fixed in 1.20.3

  3. Oct 29, 2026 · Go Vulnerability Database

    Fix available

    github.com/cert-manager/cert-manager fixed in 1.19.6

  4. Oct 29, 2026 · Go Vulnerability Database

    Fix available

    github.com/cert-manager/cert-manager fixed in 1.20.3

  5. Oct 29, 2026 · Go Vulnerability Database

    Updated

    ## Summary resources under can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an , an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses as the DNS01 provider configuration. When the direct Challenge references a , cert-manager derives the DNS provider sec

Sources

  • CVE.orgVulnerability recordCVE-2026-62290

    cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created dire

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-8rvj-mm4h-c258

    cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-62290

    Challenge resources under acme.cert-manager.io can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an Order, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses Challenge.spec.solver as the DNS01 provider configuration. When the direct Challenge reference

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygo/github.com/cert-manager/cert-manager/CVE-2026-62290.yml

    resources under can be created directly + by namespace users. On create, cert-manager performs no admission validation tying + the Challenge to an , an owner reference, or an Issuer-selected solver. The + ACME Challenge controller then reconciles the direct resource and uses + as the DNS01 provider configuration.\n\nWhen the direct Challenge references a , + cert-manager derives the DNS provider s

    gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-8rvj-mm4h-c258

    cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-8rvj-mm4h-c258

    cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

    osv.dev

References

Freshness

Last verified in this catalog Oct 29, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseOct 31, 2026
  • GitLab Advisory DatabaseOct 31, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026
  • OpenSSF OSV / OSV ScannerOct 30, 2026
  • CVE.orgOct 29, 2026