Skip to main content

CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

Bulletin ID: 2026-156-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/29/2026 09:30 AM PDT

Description:

AWS Private CA Connector for Kubernetes (aws-privateca-issuer) is an external issuer for cert-manager that signs certificate requests using AWS Private Certificate Authority. We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.

Impacted versions:

  • aws-privateca-issuer before v1.10.1;
  • AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1

Resolution:

This issue has been addressed in aws-privateca-issuer version v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on version v1.10.1-eksbuild.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Action required before upgrading: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Certificate requests that relied on the previous lenient resolution will stop renewing after the upgrade, and the services depending on them will be affected when those certificates expire. A missing or incorrect issuerRef.kind — including kind: Issuer, which cert-manager sets for Ingress annotations that do not specify an issuer kind — is now marked Failed; a request with kind: AWSPCAIssuer that references a cluster-scoped issuer now remains Pending indefinitely. Before upgrading, audit your CertificateRequest, Certificate, and Ingress resources and set issuerRef.kind explicitly to match the referenced issuer (AWSPCAIssuer for namespace-scoped, AWSPCAClusterIssuer for cluster-scoped).

Workarounds:

If you cannot upgrade immediately, scope your certificate approval policies and RBAC rules to both the issuer name and the issuer kind.

References:


Please email aws-security@amazon.com with any security questions or concerns.