HIGH 7.3 GitHub
CVE-2026-62290
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
## Summary
`Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration.
When the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and
Affected Products
- go/github.com/cert-manager/cert-manager >= 1.18.0, < 1.19.6
- go/github.com/cert-manager/cert-manager >= 1.20.0-alpha.0, < 1.20.3
References
- https://github.com/advisories/GHSA-8rvj-mm4h-c258
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258
- https://nvd.nist.gov/vuln/detail/CVE-2026-62290
- https://github.com/cert-manager/cert-manager/pull/8940
This high severity vulnerability with a CVSS score of 7.3 was published on 2026-10-29 via GitHub. Affected: go/github.com/cert-manager/cert-manager >= 1.18.0, < 1.19.6, go/github.com/cert-manager/cert-manager >= 1.20.0-alpha.0, < 1.20.3.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.