CVE-2026-62290: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62290?
CVE-2026-62290 has a high severity rating of 7.3.
How can I fix CVE-2026-62290?
To mitigate CVE-2026-62290, ensure you are using a version of cert-manager that is patched beyond 1.19.6 or 1.20.3.
What impact does CVE-2026-62290 have on my Kubernetes cluster?
CVE-2026-62290 allows direct ACME Challenge resources to bypass Issuer DNS01 solver policies, potentially exposing sensitive DNS credentials.
Which versions of cert-manager are affected by CVE-2026-62290?
CVE-2026-62290 affects cert-manager versions from 1.18.0 up to 1.19.6 and 1.20.3.
What is the risk level associated with CVE-2026-62290?
CVE-2026-62290 carries a risk level of 47, indicating a significant potential threat.