AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution
Summary
The issuer resolution logic in the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 does not correctly enforce authorization. An authenticated user whose approval policy only permits a namespace-scoped issuer may obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer they are not authorized to use. The attack requires valid cluster credentials and low privileges.
Affected
- aws-privateca-issuer before v1.10.1
- AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1
Fixed in
- aws-privateca-issuer v1.10.1
- AWS Private CA Connector for Kubernetes EKS add-on v1.10.1-eksbuild.1
Workaround
- No workaround documented by the vendor.
- If you cannot upgrade immediately, scope certificate approval policies and RBAC rules to both the issuer name and the issuer kind (vendor guidance).
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- Public proof of concept: unconfirmed.
Our recommendation
- Upgrade aws-privateca-issuer to v1.10.1 or the EKS add-on to v1.10.1-eksbuild.1.
- Before upgrading, audit CertificateRequest, Certificate and Ingress resources and set issuerRef.kind explicitly to AWSPCAIssuer (namespace-scoped) or AWSPCAClusterIssuer (cluster-scoped), because mismatched requests will fail or stay Pending and certificates may stop renewing.
- Review who can create certificate requests against cluster-scoped issuers.
- If you do not run this connector, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-156-AWS aws.amazon.com
- cert-manager aws-privateca-issuer release v1.10.1 github.com
- GitHub Security Advisory GHSA-hjrh-q6pg-mh82 github.com
- OffSeq Radar entry for CVE-2026-119115 radar.offseq.com
- Strix CVE entry CVE-2026-119115 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:51.
Original description (NVD)
Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.