{"id":"CVE-2026-119115","kind":"vulnerability","aliases":["CVE-2026-119115"],"related":[],"title":"Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes…","description":"CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes\n\n### CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes\n\nBulletin ID: 2026-156-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/29/2026 09:30 AM PDT\n\nDescription:\n\nAWS Private CA Connector for Kubernetes (aws-privateca-issuer) is an external issuer for cert-manager that signs certificate requests using AWS Private Certificate Authority. We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.\n\nImpacted versions:\n\n- aws-privateca-issuer before v1.10.1;\n- AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1\n\nResolution:\n\nThis issue has been addressed in aws-privateca-issuer version v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on version v1.10.1-eksbuild.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nAction required before upgrading: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Certificate requests that relied on the previous lenient resolution will stop renewing after the upgrade, and the services depending on them will be affected when those certificates expire. A missing or incorrect issuerRef.kind — including kind: Issuer, which cert-manager sets for Ingress annotations that do not specify an issuer kind — is now marked Failed; a request with kind: AWSPCAIssuer that references a cluster-scoped issuer now remains Pending indefinitely. Before upgrading, audit your CertificateRequest, Certificate, and Ingress resources and set issuerRef.kind explicitly to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).\n\nWorkarounds:\n\nIf you cannot upgrade immediately, scope your certificate approval policies and RBAC rules to both the issuer name and the issuer kind.\n\nReferences:\n\n- CVE-2026-119115\n- GHSA-hjrh-q6pg-mh829\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Private CA Connector for Kubernetes (aws-privateca-issuer) has an incorrect authorization check in issuer resolution. An authenticated user limited to a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-private-ca","cert-manager","eks","infrastructure","kubernetes","lab-disclosure"],"not_affected_if":["no-cluster-scoped-issuers","not-using-aws-privateca-issuer"],"how_to_check":"- Check the installed aws-privateca-issuer version and the EKS add-on version; affected versions are before `v1.10.1` and before `v1.10.1-eksbuild.1`.\n- Audit `issuerRef.kind` on CertificateRequest, Certificate and Ingress resources to see which issuer each one references.\n- Review certificate approval policies and RBAC rules for namespace-scoped users.","fix":"- aws-privateca-issuer: upgrade to `v1.10.1`\n- AWS Private CA Connector for Kubernetes EKS add-on: upgrade to `v1.10.1-eksbuild.1`\n- Before upgrading, set `issuerRef.kind` explicitly to `AWSPCAIssuer` (namespace-scoped) or `AWSPCAClusterIssuer` (cluster-scoped); requests with missing or incorrect kind will fail or stay pending after the upgrade.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T17:12:10+00:00","triaged_at":"2026-10-29T17:13:14+00:00","updated_at":"2026-10-29T17:33:47+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-29T17:13:14Z","model":"claude-haiku-5-5","output":{"fix":"- aws-privateca-issuer: upgrade to `v1.10.1`\n- AWS Private CA Connector for Kubernetes EKS add-on: upgrade to `v1.10.1-eksbuild.1`\n- Before upgrading, set `issuerRef.kind` explicitly to `AWSPCAIssuer` (namespace-scoped) or `AWSPCAClusterIssuer` (cluster-scoped); requests with missing or incorrect kind will fail or stay pending after the upgrade.","reach":"network","title":"AWS Private CA Connector for Kubernetes: issuer authorization flaw exposes certificates","impact":"high","summary":"The AWS Private CA Connector for Kubernetes (aws-privateca-issuer) has an incorrect authorization check in issuer resolution. An authenticated user limited to a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","eks","cert-manager","aws-private-ca"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user obtains subordinate CA certificates from cluster-scoped issuer","analyst_note":"Confirm exploitation conditions and whether the GHSA-hjrh-q6pg-mh829 advisory adds details on affected configurations.","how_to_check":"- Check the installed aws-privateca-issuer version and the EKS add-on version; affected versions are before `v1.10.1` and before `v1.10.1-eksbuild.1`.\n- Audit `issuerRef.kind` on CertificateRequest, Certificate and Ingress resources to see which issuer each one references.\n- Review certificate approval policies and RBAC rules for namespace-scoped users.","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-aws-privateca-issuer","no-cluster-scoped-issuers"],"who_is_affected":"Teams running the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) with cert-manager on Kubernetes or EKS, where users are granted approval policies or RBAC for namespace-scoped issuers. The flaw needs an authenticated user and only matters when cluster-scoped issuers are also in use. Clusters not using aws-privateca-issuer can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00095,"input_tokens":5040,"output_tokens":891,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119115':17A,20A,86C,101C,167C,431C '-156':117C '-2026':16A,19A,85C,100C,166C,430C '09':129C '10/29/2026':128C '2026':116C '30':130C 'action':284C 'add':232C,259C 'add-on':231C,258C 'address':241C 'affect':178C,329C 'annot':349C 'approv':187C,414C 'attent':125C 'audit':379C 'authent':55B,184C 'author':2A,49B,81B,88C,103C,160C,170C,190C,213C 'aw':9A,21B,23B,36B,43B,93C,108C,118C,120C,134C,141C,157C,219C,224C,244C,251C 'awar':163C 'aws-private-ca':22B 'aws-privateca-issu':42B,140C,218C,243C 'aws-security@amazon.com':439C 'awspcaclusterissu':296C,400C 'awspcaissu':294C,365C,395C 'bulletin':114C 'ca':11A,25B,38B,69B,95C,110C,136C,201C,226C,253C 'cannot':408C 'cert':27B,150C,344C 'cert-manag':26B,149C,343C 'certain':181C 'certif':66B,70B,154C,159C,198C,202C,306C,332C,382C,413C 'certificaterequest':381C 'check':50B 'cluster':75B,207C,370C,403C 'cluster-scop':74B,206C,369C,402C 'code':276C 'concern':445C 'condit':182C 'connector':12A,39B,96C,111C,137C,227C,254C 'content':121C 'could':64B,196C 'cve':15A,18A,84C,99C,165C,429C 'date':127C 'depend':324C 'deriv':275C 'descript':133C 'disclosur':34B 'ek':29B,230C,257C 'email':438C 'enforc':289C 'ensur':271C 'exact':293C 'expir':333C 'explicit':389C 'extern':146C 'fail':360C 'fix':283C 'fork':273C 'ghsa':433C 'ghsa-hjrh-q6pg-mh829':432C 'hjrh':434C 'id':115C 'immedi':410C 'impact':216C 'import':123C 'includ':67B,199C,339C 'incorpor':280C 'incorrect':1A,48B,87C,102C,169C,337C 'indefinit':376C 'infrastructur':30B 'ingress':348C,384C 'issu':171C,238C 'issuer':5A,45B,52B,63B,77B,90C,105C,143C,147C,174C,195C,209C,221C,246C,303C,341C,355C,372C,394C,422C,426C 'issuerref.kind':291C,338C,388C 'kind':300C,340C,356C,364C,427C 'kubernet':14A,31B,41B,98C,113C,139C,229C,256C 'lab':33B 'lab-disclosur':32B 'latest':268C 'lenient':313C 'limit':57B 'logic':7A,176C 'manag':28B,151C,345C 'mark':359C 'match':298C,391C 'mh829':436C 'miss':335C 'name':423C 'namespac':61B,193C,398C 'namespace-scop':60B,192C,397C 'new':282C 'obtain':65B,197C 'patch':278C 'pdt':132C 'pend':375C 'pleas':437C 'polici':188C,415C 'previous':312C 'privat':10A,24B,37B,94C,109C,135C,158C,225C,252C 'privateca':44B,142C,220C,245C 'public':126C 'q6pg':435C 'question':443C 'rbac':417C 'recommend':264C 'refer':305C,367C,428C 'referenc':393C 'reli':309C 'remain':374C 'renew':317C 'request':155C,307C,362C 'requir':124C,285C 'resolut':6A,53B,91C,106C,175C,236C,314C 'resourc':385C 'rule':418C 'scope':62B,76B,119C,194C,208C,371C,399C,404C,411C 'secur':442C 'servic':323C 'set':346C,387C 'sign':71B,153C,203C 'specifi':353C 'stop':316C 'subordin':68B,200C 'type':122C 'upgrad':265C,287C,320C,378C,409C 'use':83B,156C,215C 'user':56B,185C 'v1.10.1':223C,248C,288C 'v1.10.1-eksbuild.1':235C,262C 'version':179C,217C,247C,261C,269C 'whose':186C 'workaround':405C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) with cert-manager on Kubernetes or EKS, where users are granted approval policies or RBAC for namespace-scoped issuers. The flaw needs an authenticated user and only matters when cluster-scoped issuers are also in use. Clusters not using aws-privateca-issuer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/#CVE-2026-119115","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/","severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T17:12:10+00:00","fetched_at":"2026-10-29T17:12:10+00:00","note":"AWS: CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes"},{"source":"nvd","external_id":"CVE-2026-119115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119115","severity":null,"published_at":"2026-10-29T17:18:07+00:00","modified_at":"2026-10-29T17:18:07+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null}],"documents":[{"id":18100,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/","title":"AWS: CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes\n\n### CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes\n\nBulletin ID: 2026-156-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/29/2026 09:30 AM PDT\n\nDescription:\n\nAWS Private CA Connector for Kubernetes (aws-privateca-issuer) is an external issuer for cert-manager that signs certificate requests using AWS Private Certificate Authority. We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.\n\nImpacted versions:\n\n- aws-privateca-issuer before v1.10.1;\n- AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1\n\nResolution:\n\nThis issue has been addressed in aws-privateca-issuer version v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on version v1.10.1-eksbuild.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nAction required before upgrading: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Certificate requests that relied on the previous lenient resolution will stop renewing after the upgrade, and the services depending on them will be affected when those certificates expire. A missing or incorrect issuerRef.kind — including kind: Issuer, which cert-manager sets for Ingress annotations that do not specify an issuer kind — is now marked Failed; a request with kind: AWSPCAIssuer that references a cluster-scoped issuer now remains Pending indefinitely. Before upgrading, audit your CertificateRequest, Certificate, and Ingress resources and set issuerRef.kind explicitly to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).\n\nWorkarounds:\n\nIf you cannot upgrade immediately, scope your certificate approval policies and RBAC rules to both the issuer name and the issuer kind.\n\nReferences:\n\n- CVE-2026-119115\n- GHSA-hjrh-q6pg-mh829\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-29T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}