CVE-2026-62290 with a CVSS score of 7.3 is a cert-manager ACME Challenge admission-validation and controller flaw, classified as CWE-863, in which directly created Challenge resources can bypass Issuer or ClusterIssuer DNS01 solver policy. The affected software is github.com/cert-manager/cert-manager (go) versions >= 1.18.0, < 1.19.6 and github.com/cert-manager/cert-manager (go) versions >= 1.20.0-alpha.0, < 1.20.3. A namespace user who can create challenges.acme.cert-manager.io resources, while the controller reconciles Challenges cluster-wide and a usable ClusterIssuer exists with a DNS01 solver backed by a Secret or ambient credentials, can submit a direct Challenge whose issuerRef points to that ClusterIssuer but whose spec.solver contains attacker-selected provider settings. The controller derives credential namespace and ambient-credential permission from the ClusterIssuer reference while accepting the untrusted solver configuration, allowing platform DNS credentials to be used outside intended selectors such as dnsZones, dnsNames, and matchLabels. With acme-dns, the attacker-controlled host receives X-Api-User and X-Api-Key values, causing credential disclosure; with other providers, impact includes credential use, policy bypass, and unauthorized DNS mutation.
We recommend you to update cert-manager to version 1.19.6, 1.20.3 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-62290 with a CVSS score of 7.3 is a cert-manager ACME Challenge admission-validation and controller flaw, classified as CWE-863, in which directly created Challenge resources can bypass Issuer or ClusterIssuer DNS01 solver policy. The affected software is github.com/cert-manager/cert-manager (go) versions >= 1.18.0, < 1.19.6 and github.com/cert-manager/cert-manager (go) versions >= 1.20.0-alpha.0, < 1.20.3. A namespace user who can create challenges.acme.cert-manager.io resources, while the controller reconciles Challenges cluster-wide and a usable ClusterIssuer exists with a DNS01 solver backed by a Secret or ambient credentials, can submit a direct Challenge whose issuerRef points to that ClusterIssuer but whose spec.solver contains attacker-selected provider settings. The controller derives credential namespace and ambient-credential permission from the ClusterIssuer reference while accepting the untrusted solver configuration, allowing platform DNS credentials to be used outside intended selectors such as dnsZones, dnsNames, and matchLabels. With acme-dns, the attacker-controlled host receives X-Api-User and X-Api-Key values, causing credential disclosure; with other providers, impact includes credential use, policy bypass, and unauthorized DNS mutation.
We recommend you to update cert-manager to version 1.19.6, 1.20.3 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]