Live › vulnerability › CVE-2026-119115
The AWS Private CA Connector for Kubernetes (aws-privateca-issuer) has an incorrect authorization check in issuer resolution. An authenticated user limited to a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:12 UTC, 0h before NVD. All times on this page are UTC.
Teams running the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) with cert-manager on Kubernetes or EKS, where users are granted approval policies or RBAC for namespace-scoped issuers. The flaw needs an authenticated user and only matters when cluster-scoped issuers are also in use. Clusters not using aws-privateca-issuer can skip it.
No product ranges from the sources yet.
v1.10.1 and before v1.10.1-eksbuild.1.issuerRef.kind on CertificateRequest, Certificate and Ingress resources to see which issuer each one references.v1.10.1v1.10.1-eksbuild.1issuerRef.kind explicitly to AWSPCAIssuer (namespace-scoped) or AWSPCAClusterIssuer (cluster-scoped); requests with missing or incorrect kind will fail or stay pending after the upgrade.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
Bulletin ID: 2026-156-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/29/2026 09:30 AM PDT
Description:
AWS Private CA Connector for Kubernetes (aws-privateca-issuer) is an external issuer for cert-manager that signs certificate requests using AWS Private Certificate Authority. We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.
Impacted versions:
Resolution:
This issue has been addressed in aws-privateca-issuer version v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on version v1.10.1-eksbuild.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Action required before upgrading: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Certificate requests that relied on the previous lenient resolution will stop renewing after the upgrade, and the services depending on them will be affected when those certificates expire. A missing or incorrect issuerRef.kind — including kind: Issuer, which cert-manager sets for Ingress annotations that do not specify an issuer kind — is now marked Failed; a request with kind: AWSPCAIssuer that references a cluster-scoped issuer now remains Pending indefinitely. Before upgrading, audit your CertificateRequest, Certificate, and Ingress resources and set issuerRef.kind explicitly to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).
Workarounds:
If you cannot upgrade immediately, scope your certificate approval policies and RBAC rules to both the issuer name and the issuer kind.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-119115")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.