https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 08:18:45 +0000 https://db.gcve.eu/vuln/certfr-2026-avi-1486 certfr-2026-avi-1486 https://db.gcve.eu/vuln/certfr-2026-avi-1486 https://db.gcve.eu/vuln/fkie_cve-2026-62290 <p>cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.</p> <p>cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-62290 https://db.gcve.eu/vuln/ghsa-8rvj-mm4h-c258 <p><strong>Affected:</strong> Go: github.com/cert-manager/cert-manager</p> <p>## Summary</p> <p>`Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration.</p> <p>When the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and ambient-credential policy from the `ClusterIssuer` reference, but the DNS provider configuration itself is attacker-controlled through `Challenge.spec.solver`. This lets a namespace user bypass `Issuer`/`ClusterIssuer` solver selectors such as `dnsZones`, `dnsNames`, and `matchLabels`, and make the cert-manager controller use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names.</p> <p>In the acme-dns case, this becomes credential disclosure because the attacker-controlled solver host receives the `X-Api-User` and `X-Api-Key` headers loaded by cert-manager from the ClusterIssuer resource namespace.</p> <p>## Attack preconditions</p> <p>- The attacker can create `challenges.acme.cert-manager.io` resources in at least one namespace. - The cert-manager controller is running and reconciles ACME `Challenge` resources cluster-wide. - A usable `ClusterIssuer` exists in the cluster. - The referenced `ClusterIssuer` has a DNS01 solver that uses a Secret in the cluster resource na…</p> <p><strong>Affected:</strong> Go: github.com/cert-manager/cert-manager</p> <p>## Summary</p> <p>`Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration.</p> <p>When the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and ambient-credential policy from the `ClusterIssuer` reference, but the DNS provider configuration itself is attacker-controlled through `Challenge.spec.solver`. This lets a namespace user bypass `Issuer`/`ClusterIssuer` solver selectors such as `dnsZones`, `dnsNames`, and `matchLabels`, and make the cert-manager controller use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names.</p> <p>In the acme-dns case, this becomes credential disclosure because the attacker-controlled solver host receives the `X-Api-User` and `X-Api-Key` headers loaded by cert-manager from the ClusterIssuer resource namespace.</p> <p>## Attack preconditions</p> <p>- The attacker can create `challenges.acme.cert-manager.io` resources in at least one namespace. - The cert-manager controller is running and reconciles ACME `Challenge` resources cluster-wide. - A usable `ClusterIssuer` exists in the cluster. - The referenced `ClusterIssuer` has a DNS01 solver that uses a Secret in the cluster resource na…</p> https://db.gcve.eu/vuln/ghsa-8rvj-mm4h-c258