Denial of Service Vulnerability in cert-manager for Kubernetes by Jetstack
CVE-2026-25518
What is CVE-2026-25518?
The cert-manager component for Kubernetes, developed by Jetstack, faces a vulnerability during its DNS-01 processing for certificate management. Specifically, in the specified versions, the cert-manager-controller relies on unencrypted DNS lookups for zone discovery and self-checks during the Automated Certificate Management Environment (ACME) process. This reliance exposes the system to potential exploitation from attackers capable of intercepting and altering DNS traffic within the cert-manager-controller pod. Such malicious actors can insert misleading entries into the DNS cache, resulting in a panic state when accessed and causing a denial-of-service (DoS) condition. Notably, if the authoritative DNS server is compromised, the risk escalates further. Users are urged to upgrade to the patched versions to mitigate this vulnerability.
Affected Version(s)
cert-manager >= 1.18.0, < 1.18.5 < 1.18.0, 1.18.5
cert-manager >= 1.19.0, < 1.19.3 < 1.19.0, 1.19.3