DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-62290: CVE-2026-62290: ClusterIssuer DNS01 Solver Policy Bypass and Credential Exfiltration in cert-manager

#security #cve #cybersecurity

CVE-2026-62290: ClusterIssuer DNS01 Solver Policy Bypass and Credential Exfiltration in cert-manager

Vulnerability ID: CVE-2026-62290
CVSS Score: 7.3
Published: 2026-10-29

CVE-2026-62290 is an incorrect authorization vulnerability (CWE-863) in cert-manager that allows low-privileged Kubernetes namespace tenants to bypass ClusterIssuer DNS01 solver policies and exfiltrate cluster-scoped DNS credentials. By directly creating standalone ACME Challenge custom resources rather than going through the standard Certificate and Order workflow, an attacker can specify arbitrary solver provider configurations while referencing a privileged ClusterIssuer. The cert-manager ACME challenge controller reconciles these directly instantiated Challenge resources without verifying their parentage or validating the user-supplied solver parameters against the referenced ClusterIssuer's selector policies.

TL;DR

Overly permissive default aggregate RBAC rules in cert-manager allow namespace users with 'edit' permissions to directly create ACME Challenge resources. Because the ACME challenge controller trusts the solver configuration embedded inside a Challenge resource while deriving credential access authority from the referenced ClusterIssuer, an attacker can craft a Challenge that redirects cluster-scoped DNS credentials to an attacker-controlled server or performs unauthorized DNS record mutations across protected zones.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability Type: CWE-863: Incorrect Authorization
  • CVSS v3.1 Score: 7.3 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)
  • Affected Component: cert-manager ACME Challenge Controller & Default Helm RBAC
  • Attack Vector: Direct creation of standalone Challenge CRDs referencing a ClusterIssuer
  • Security Impact: Cluster-scoped DNS credential exfiltration and DNS01 solver policy bypass
  • EPSS Score: 0.11% (1.35th percentile)
  • Exploit Status: Proof-of-Concept verified in upstream advisory
  • Patched Versions: v1.19.6, v1.20.3

Affected Systems

  • cert-manager (github.com/cert-manager/cert-manager)
  • cert-manager: >= 1.18.0, < 1.19.6 (Fixed in: 1.19.6)
  • cert-manager: >= 1.20.0, < 1.20.3 (Fixed in: 1.20.3)

Code Analysis

Commit: 6bda472

Remove 'create' on challenges and 'create', 'patch', 'update' on orders from the aggregate edit ClusterRole (release-1.20).

@@ -514,9 +514,23 @@ rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["certificates/status"]
     verbs: ["update"]
+  {{- /*
+    Challenge and Order resources are not intended to be created or
+    modified directly by users.
+
+    Challenges: "create" is excluded. "patch" and "update" are retained
+    because spec is immutable after creation (ValidateChallengeUpdate)
+    and because users need them to remove stuck finalizers
+    (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
+
+    Orders: "create", "patch", and "update" are excluded.
+  */}}
   - apiGroups: ["acme.cert-manager.io"]
-    resources: ["challenges", "orders"]
-    verbs: ["create", "delete", "deletecollection", "patch", "update"]
+    resources: ["challenges"]
+    verbs: ["delete", "deletecollection", "patch", "update"]
+  - apiGroups: ["acme.cert-manager.io"]
+    resources: ["orders"]
+    verbs: ["delete", "deletecollection"]
Enter fullscreen mode Exit fullscreen mode

Commit: b37dbf0

Remove 'create' on challenges and 'create', 'patch', 'update' on orders from the aggregate edit ClusterRole (release-1.19).

@@ -514,9 +514,23 @@ rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["certificates/status"]
     verbs: ["update"]
+  {{- /*
+    Challenge and Order resources are not intended to be created or
+    modified directly by users.
+
+    Challenges: "create" is excluded. "patch" and "update" are retained
+    because spec is immutable after creation (ValidateChallengeUpdate)
+    and because users need them to remove stuck finalizers
+    (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
+
+    Orders: "create", "patch", and "update" are excluded.
+  */}}
   - apiGroups: ["acme.cert-manager.io"]
-    resources: ["challenges", "orders"]
-    verbs: ["create", "delete", "deletecollection", "patch", "update"]
+    resources: ["challenges"]
+    verbs: ["delete", "deletecollection", "patch", "update"]
+  - apiGroups: ["acme.cert-manager.io"]
+    resources: ["orders"]
+    verbs: ["delete", "deletecollection"]
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory: Official upstream advisory containing technical reproduction steps and PoC details for direct Challenge creation and credential exfiltration.

Mitigation Strategies

  • Upgrade cert-manager to v1.19.6 or v1.20.3 to remove 'create' permissions on Challenge and Order resources from the aggregate 'cert-manager-edit' ClusterRole.
  • Audit all custom Kubernetes Roles and ClusterRoles to ensure non-system principals are not granted 'create' or wildcard ('*') permissions on 'challenges.acme.cert-manager.io'.
  • Enforce a Kubernetes ValidatingAdmissionPolicy, OPA Gatekeeper constraint, or Kyverno policy that blocks 'CREATE' operations on 'challenges.acme.cert-manager.io' from any principal other than the cert-manager controller service account.
  • Ensure the cert-manager validating admission webhook is enabled and configured with 'failurePolicy: Fail' so that 'Challenge.spec' immutability is strictly enforced on 'UPDATE' and 'PATCH' operations.

Remediation Steps:

  1. Upgrade cert-manager 1.18.x and 1.19.x deployments to v1.19.6 or later.
  2. Upgrade cert-manager 1.20.x deployments to v1.20.3 or later.
  3. If unable to upgrade immediately, patch the 'cert-manager-edit' ClusterRole to strip 'create' from 'challenges' and 'create', 'patch', and 'update' from 'orders'.
  4. Run an RBAC audit across all namespaces to identify and revoke any bespoke roles granting 'create' on 'challenges.acme.cert-manager.io'.
  5. Optionally deploy a ValidatingAdmissionPolicy to restrict 'challenges.acme.cert-manager.io' creation strictly to 'system:serviceaccount:cert-manager:cert-manager'.

References

Read the full report for CVE-2026-62290 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (1)

Collapse
 
fgrandon profile image
Francisco Grandón •

Great breakdown of CVE-2026-62290. The analysis clearly illustrates the critical danger of overly permissive default aggregate RBAC in cert-manager, particularly when namespace tenants can directly instantiate standalone ACME Challenge custom resources to bypass ClusterIssuer policies. Isolating and remediating these credential exfiltration vectors at the controller level is a vital architectural insight for any multi-tenant Kubernetes cluster.

How do you recommend platform teams monitor or enforce admission controls (such as Kyverno or OPA/Gatekeeper) to catch standalone Challenge resources before they even hit the controller?