Vulnerability GO-2026-6889
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:55 PM UTC
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager
>=1.18.0 <1.19.6, >=1.20.0-alpha.0 <1.20.3
>=1.18.0 <1.19.6, >=1.20.0-alpha.0 <1.20.3
Summary
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager
Details
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 days ago
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
>=1.18.0 <1.19.6, >=1.20.0-alpha.0 <1.20.3 GHSA-8rvj-mm4h-c258
>=1.18.0 <1.19.6, >=1.20.0-alpha.0 <1.20.3 GHSA-8rvj-mm4h-c258
Unknown
8 months ago
DoS in cert-manager-controller via Specially Crafted DNS Response in github.com/cert-manager/cert-manager
>=1.18.0 <1.18.5, >=1.19.0 <1.19.3 GO-2026-4399
>=1.18.0 <1.18.5, >=1.19.0 <1.19.3 GO-2026-4399
Medium Risk
9 months ago
cert-manager-controller DoS via Specially Crafted DNS Response
>=1.18.0 <1.18.5, >=1.19.0 <1.19.3 GHSA-gx3x-vq4p-mhhv
>=1.18.0 <1.18.5, >=1.19.0 <1.19.3 GHSA-gx3x-vq4p-mhhv
Unknown
1 year ago
Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
<1.12.14, >=1.13.0-alpha.0 <1.15.4, >=1.16.0-alpha.0 <1.16.2 GO-2024-3282
<1.12.14, >=1.13.0-alpha.0 <1.15.4, >=1.16.0-alpha.0 <1.16.2 GO-2024-3282
Medium Risk
1 year ago
cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs
<1.12.14, >=1.13.0-alpha.0 <1.15.4, >=1.16.0-alpha.0 <1.16.2 GHSA-r4pg-vg54-wxx4
<1.12.14, >=1.13.0-alpha.0 <1.15.4, >=1.16.0-alpha.0 <1.16.2 GHSA-r4pg-vg54-wxx4
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:55 PM UTC
Fixed (v1.20.3)
4 months ago
June 25, 2026 at 10:38 AM UTC
Fixed (v1.19.6)
4 months ago
June 25, 2026 at 02:09 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:25 PM UTC