Auth bypass in Cert-manager
CVE-2026-62290
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under…
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Cert-manager — versions >= 1.18.0, < 1.19.6, >= 1.20.0, < 1.20.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-62290?
- CVE-2026-62290 is a high-severity vulnerability in Cert-manager, classified under Incorrect Authorization. CVSS score: 7.3/10. Published 2026-07-16.
- How severe is CVE-2026-62290?
- High severity. CVSS v3 base score is 7.3 out of 10.