Security1 hOctober 30, 2026, 07:30

cert-manager CVE-2026-62290 allows DNS01 policy bypass and credential theft

CVE-2026-62290 (CVSS 7.3) in cert-manager lets namespace users with edit rights create ACME Challenge resources directly, bypassing ClusterIssuer DNS01 solver policies and exfiltrating cluster-scoped DNS credentials. Fixes ship in versions 1.19.6 and 1.20.3.

DEV Community

Open source

cert-manager CVE-2026-62290 allows DNS01 policy bypass and credential theft

CVE-2026-62290 rated 7.3 CVSS, classified as CWE-863
Affects versions 1.18.0–1.19.5 and 1.20.0–1.20.2
Patched in cert-manager 1.19.6 and 1.20.3
Proof-of-concept exploit confirmed, EPSS 0.11%

#Cert-manager#Kubernetes

cert-manager keeps old keystore password until certificate re-issuance

Security

Kubernetes checkpoint restore bypasses destination security policy

Security

DolphinScheduler 3.4.3 patch leaves stolen credentials valid

Security

cert-manager CVE-2026-62290 allows DNS01 policy bypass and credential theft

cert-manager keeps old keystore password until certificate re-issuance

Kubernetes checkpoint restore bypasses destination security policy

DolphinScheduler 3.4.3 patch leaves stolen credentials valid

Storm-3068 hijacked account via SSPR and stole Kubernetes credentials