Authorization Flaw in AWS Private CA Connector for Kubernetes by Amazon Web Services
CVE-2026-119115

8.4HIGH

Key Information:

Vendor

Aws

Status
Aws-privateca-issuer
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119115?

A vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes prior to version v1.10.1 could allow an authenticated remote user to improperly obtain certificates, including subordinate CA certificates, from a cluster-scoped AWS Private CA issuer. This occurs due to incorrect authorization checks, potentially violating an approval policy that should restrict access to these certificates. To remediate this issue, it is essential to upgrade aws-privateca-issuer to v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1. Additionally, users must review and update any related certificate requests and configurations to ensure they comply with the new requirements for issuer reference.

Affected Version(s)

aws-privateca-issuer 0 < 1.10.1

aws-privateca-issuer 0 < 1.10.1-eksbuild.1

References

https://github.com/cert-manager/aws-privateca-issuer/rele...
release-notespatch
https://github.com/cert-manager/aws-privateca-issuer/secu...
vendor-advisory
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.