{"action":"Upgrade github.com/cert-manager/cert-manager to 1.19.6 (1.19.x) or 1.20.3 (1.20.x) or later.","affected":[{"fixed":"1.19.6","introduced":"1.18.0"},{"fixed":"1.20.3","introduced":"1.20.0-alpha.0"}],"component":"github.com/cert-manager/cert-manager","cve_ids":["CVE-2026-62290"],"ecosystem":"Go","epss":0.00112,"exploited":false,"fixed_versions":["1.19.6","1.20.3"],"ghsa_id":"GHSA-8rvj-mm4h-c258","id":"tcs_01M6495SMZ0QWT621VF164M049","modified_at":"2026-10-29T16:45:05.112882474Z","published_at":"2026-10-29T16:39:41Z","references":["https://osv.dev/vulnerability/GHSA-8rvj-mm4h-c258","https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258","https://nvd.nist.gov/vuln/detail/CVE-2026-62290","https://github.com/cert-manager/cert-manager/pull/8940","https://github.com/cert-manager/cert-manager/pull/8941","https://github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155","https://github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16","https://github.com/cert-manager/cert-manager","https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6","https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-8rvj-mm4h-c258","url":"https://osv.dev/vulnerability/GHSA-8rvj-mm4h-c258"}],"summary":"cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials"}