---
id: "CVE-2026-119115"
kind: "vulnerability"
aliases: ["CVE-2026-119115"]
title: "Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes\u2026"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "aws-private-ca", "cert-manager", "eks", "infrastructure", "kubernetes", "lab-disclosure"]
not_affected_if: ["no-cluster-scoped-issuers", "not-using-aws-privateca-issuer"]
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-29T17:12:10+00:00"
updated_at: "2026-10-29T17:33:47+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/", "first_seen_at": "2026-10-29T17:12:10+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119115", "first_seen_at": "2026-10-29T17:26:17+00:00"}]
---

# Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes…

The AWS Private CA Connector for Kubernetes (aws-privateca-issuer) has an incorrect authorization check in issuer resolution. An authenticated user limited to a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed aws-privateca-issuer version and the EKS add-on version; affected versions are before `v1.10.1` and before `v1.10.1-eksbuild.1`.
- Audit `issuerRef.kind` on CertificateRequest, Certificate and Ingress resources to see which issuer each one references.
- Review certificate approval policies and RBAC rules for namespace-scoped users.

## Fix

- aws-privateca-issuer: upgrade to `v1.10.1`
- AWS Private CA Connector for Kubernetes EKS add-on: upgrade to `v1.10.1-eksbuild.1`
- Before upgrading, set `issuerRef.kind` explicitly to `AWSPCAIssuer` (namespace-scoped) or `AWSPCAClusterIssuer` (cluster-scoped); requests with missing or incorrect kind will fail or stay pending after the upgrade.

## Timeline

- 2026-10-29T17:12:10+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/ — AWS: CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119115

## Documents

- [advisory] AWS: CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes https://aws.amazon.com/security/security-bulletins/rss/2026-156-aws/

## From the sources

CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

### CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

Bulletin ID: 2026-156-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/29/2026 09:30 AM PDT

Description:

AWS Private CA Connector for Kubernetes (aws-privateca-issuer) is an external issuer for cert-manager that signs certificate requests using AWS Private Certificate Authority. We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.

Impacted versions:

- aws-privateca-issuer before v1.10.1;
- AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1

Resolution:

This issue has been addressed in aws-privateca-issuer version v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on version v1.10.1-eksbuild.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Action required before upgrading: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Certificate requests that relied on the previous lenient resolution will stop renewing after the upgrade, and the services depending on them will be affected when those certificates expire. A missing or incorrect issuerRef.kind — including kind: Issuer, which cert-manager sets for Ingress annotations that do not specify an issuer kind — is now marked Failed; a request with kind: AWSPCAIssuer that references a cluster-scoped issuer now remains Pending indefinitely. Before upgrading, audit your CertificateRequest, Certificate, and Ingress resources and set issuerRef.kind explicitly to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).

Workarounds:

If you cannot upgrade immediately, scope your certificate approval policies and RBAC rules to both the issuer name and the issuer kind.

References:

- CVE-2026-119115
- GHSA-hjrh-q6pg-mh829

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_