{"id":"ghsa-ghsa-8rvj-mm4h-c258","seq":2248348,"kind":"advisory","title":"cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials","url":"https://github.com/advisories/GHSA-8rvj-mm4h-c258","permalink":"https://vulnpulse.app/items/ghsa-ghsa-8rvj-mm4h-c258","summary":"影響: go:github.com/cert-manager/cert-manager >= 1.18.0, < 1.19.6 → 1.19.6, go:github.com/cert-manager/cert-manager >= 1.20.0-alpha.0, < 1.20.3 → 1.20.3\nChallenge resources under acme.cert-manager.io can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an Order, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses Challenge.spec.solver as the DNS01 provider configuration. When the direct Challenge references a ClusterIssuer, cert-manager derives the DNS provider secret namespace and ambient-credential po…","severity":"high","techs":["go","github"],"cves":["CVE-2026-62290"],"tags":["GHSA-8rvj-mm4h-c258","github.com/cert-manager/cert-manager","github.com/cert-manager/cert-manager"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-29T16:39:41.000Z","fetched_at":"2026-10-29T16:39:51.401Z"}