Admission validation bypass in cert-manager (CVE-2026-62290)

cert-manager (github.com/cert-manager/cert-manager) contains a vulnerability where namespace users can directly create Challenge resources under acme.cert-manager.io without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver. This allows a namespace user to supply attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer, bypassing DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels, and causing the cert-manager controller to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names; in the acme-dns case, this results in disclosure of X-Api-User and X-Api-Key headers to an attacker-controlled endpoint. Affected versions: - >= 1.18.0, <= 1.20.2 We recommend updating to: 1.19.6, 1.20.3. CVSS 7.3 · our assessment: this_week Vendor advisory: https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258 Details: https://vuln.today/cve/CVE-2026-62290