GO-2026-6859 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-efs, node-feature-discovery-fips, dbmate, container-object-storage-interface-fips, fleet-server, amazon-ssm-agent-fips, grafana-cloudmonitoring-datasource, kube-bench-fips, crossplane-provider-aws-elb-fips, crossplane-provider-terraform,...

CLEANSTART-2026-MG33162 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the cert-manager package. gRPC-Go is the Go language implementation of gRPC...

GO-2026-6889 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, kuberay-operator, mariadb-operator, cert-manager-webhook-pdns, step-issuer, percona-server-mongodb-operator, cert-manager-istio-csr, aws-privateca-issuer, cert-manager-cmctl...

GO-2026-6889 vulnerabilities

Vulnerabilities for packages: cert-manager-openshift-routes, percona-server-mongodb-operator, cert-manager-csi-driver-fips, percona-xtradb-cluster-operator, cert-manager-cmctl-fips, redpanda-operator, percona-server-mongodb-operator-fips, aws-privateca-issuer-fips, cert-manager-webhook-pdns-fips,...

CLEANSTART-2026-BF43581 Security fix for GHSA-2v4p-qf9q-27wj applied in: cert-manager 1.20.5-r1

Security vulnerability affects the cert-manager package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KW07781 Security fix for GHSA-78h2-9frx-2jm8 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, step-ca-fips 0.30.2-r1, trillian-fips 1.7.3-r1, kaniko 1.24.0-r2, cert-manager 1.19.4-r1, opentofu-fips 1.9.4-r5, opentofu-fips 1.7.10-r5, opentofu-fips 1.8.11-r5, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

GHSA-78h2-9frx-2jm8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG54423 Security fix for GHSA-p77j-4mvh-x3m3 applied in: helm-fips 3.20.2-r0, dynamic-localpv-provisioner 4.5.0-r1, argo-workflows 3.6.19-r3, fulcio-fips 1.8.7-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, litestream 0.5.14-r1, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, cert-manager 1.19.4-r1

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GHSA-8RVJ-MM4H-C258 vulnerabilities

Vulnerabilities for packages: cert-manager-openshift-routes, percona-server-mongodb-operator, cert-manager-csi-driver-fips, percona-xtradb-cluster-operator, cert-manager-cmctl-fips, redpanda-operator, percona-server-mongodb-operator-fips, aws-privateca-issuer-fips, cert-manager-webhook-pdns-fips,...

GHSA-8RVJ-MM4H-C258 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, kuberay-operator, mariadb-operator, cert-manager-webhook-pdns, step-issuer, percona-server-mongodb-operator, cert-manager-istio-csr, aws-privateca-issuer, cert-manager-cmctl...

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

Summary Challenge resources under acme.cert-manager.io can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an Order, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct...

GHSA-8RVJ-MM4H-C258 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

Summary Challenge resources under acme.cert-manager.io can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an Order, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct...

EUVD-2026-45017

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials...

CVE-2026-63209 vulnerabilities

Vulnerabilities for packages: k3d, kyverno, commercial-expanso-edge, commercial-kyverno, zot, prometheus, terraform, flux, loki, omnictl-multiarch-fips, nerdctl, commercial-grafana, k3s, prometheus-operator, spire-server, containerd, backup-restore-operator, falco-no-driver,...

GHSA-VWCJ-R8V9-P53F vulnerabilities

Vulnerabilities for packages: helm, nerdctl, loki, kots, snyk-cli, step-issuer, rclone, zot, gitea, caddy, wuzz, fuse-overlayfs-snapshotter, mailpit, external-dns, k3s, cilium-cli, prometheus-operator, runc, kubernetes, k6, hugo-extended, vale, telegraf, kyverno, kine, flux, step,...

AZL-111836 CVE-2026-97045 affecting package cert-manager 1.12.15-15

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-111833 CVE-2026-78661 affecting package cert-manager 1.12.15-15

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

AZL-111827 CVE-2026-116591 affecting package cert-manager 1.12.15-15

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

AZL-111821 CVE-2026-116586 affecting package cert-manager 1.12.15-15

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111830 CVE-2026-116587 affecting package cert-manager 1.12.15-15

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

AZL-111824 CVE-2026-116585 affecting package cert-manager 1.12.15-15

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...