CVE-2026-62290

Name of the Vulnerable Software and Affected Versions cert-manager versions 1.18.0 through 1.19.5 cert-manager versions 1.20.0 through 1.20.2

Description Namespace users can create Challenge resources under acme.cert-manager.io without admission validation that ties the Challenge to an Order, owner reference, or Issuer-selected solver. This allows an attacker to control Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors, including dnsZones, dnsNames, and matchLabels. Consequently, cert-manager may use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, which can lead to the disclosure of X-Api-User and X-Api-Key headers for acme-dns.

Recommendations Update to version 1.19.6. Update to version 1.20.3.