HighVulnerabilityCVE-2026-62290updated 29 Oct 2026, 16:40 UTC

cert-manager lets namespace users bypass DNS solver rules and use cluster DNS credentials

Anyone allowed to create ACME challenge objects in their own namespace can make cert-manager use the cluster's DNS provider credentials for settings the admin never approved. With acme-dns, the secret login details can be sent to a server t

Fixed in cert-manager 1.19.6 and 1.20.3Official source

Severity	HighCVSS 7.3 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yescert-manager 1.19.6 and 1.20.3 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Tenant userHas permission to create Challenge objects
2Crafted ChallengeSets its own DNS solver settings
3cert-manager controllerTrusts solver config without checking the Issuer
4ClusterIssuer secretCluster DNS credentials loaded
5Credentials sent outSent to attacker-chosen DNS host
ResultCluster DNS credentials exposed or misused

What happened

Direct creation of cert-manager 'Challenge' resources (acme.cert-manager.io) is not validated against the referenced Issuer/ClusterIssuer; the controller trusts Challenge.spec.solver for DNS01 provider config, so solver selectors (dnsZones, dnsNames, matchLabels) can be bypassed and ClusterIssuer DNS credentials used with attacker-chosen settings.

Why it is dangerous: Namespace tenants can cause the cluster-wide controller to use DNS or ambient cloud credentials outside policy, potentially disclosing acme-dns credentials to an attacker endpoint and enabling unauthorized DNS changes. Multi-tenant clusters are at highest risk.

Are you affected?

You are affected if you run cert-manager 1.18.0 to before 1.19.6, or 1.20.0-alpha.0 to before 1.20.3, and use a ClusterIssuer with DNS01 solvers (Secret-based or ambient credentials) in a cluster where namespace users can create challenges.acme.cert-manager.io resources.

Package / product	Affected versions	Fixed in
github.com/cert-manager/cert-manager · go	>= 1.18.0, < 1.19.6	1.19.6
github.com/cert-manager/cert-manager · go	>= 1.20.0-alpha.0, < 1.20.3	1.20.3

What to do

Upgrade cert-manager to 1.19.6 or 1.20.3 or later
Until patched, restrict create permissions on challenges.acme.cert-manager.io, including via the aggregate edit role
Rotate DNS provider and acme-dns credentials if a namespace user may have had create access on Challenge resources

Timeline

29 Oct 2026, 16:39 UTC
Publicly disclosed
29 Oct 2026, 16:39 UTC
Reported by GitHub Advisory · GitHub Advisory
29 Oct 2026, 16:40 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsGitHub Advisory · 29 Oct 2026, 16:39 UTC

Technical details

ID: CVE-2026-62290 · GHSA-8rvj-mm4h-c258
CVSS: 7.3 / 10
EPSS: 0.1% chance of exploitation within 30 days
Disclosed: 29 Oct 2026, 16:39 UTC
On Zero Radar: 29 Oct 2026, 16:40 UTC (1 min after disclosure)
Last change: 29 Oct 2026, 16:40 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works