Cloud service vulnerability, severity medium
AWS Private CA Connector for Kubernetes issuer resolution authorization flaw (CVE-2026-119115)
Published , updated
CVE-2026-119115 is an incorrect authorization flaw in issuer resolution in aws-privateca-issuer, the cert-manager external issuer for AWS Private CA. An authenticated user whose approval policy covers only a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use. Versions before v1.10.1, and the EKS add-on before v1.10.1-eksbuild.1, are affected.
What's affected
- aws eks kubernetesevery version
What to do
- Upgrade aws-privateca-issuer to v1.10.1 or the EKS add-on to v1.10.1-eksbuild.1, and patch any forked or derivative code.
- Before upgrading, audit CertificateRequest, Certificate and Ingress resources and set issuerRef.kind explicitly to AWSPCAIssuer (namespace-scoped) or AWSPCAClusterIssuer (cluster-scoped), otherwise renewals will fail or stay Pending.
- If you cannot upgrade immediately, scope certificate approval policies and RBAC rules to both the issuer name and the issuer kind.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident aws-privateca-issuer-authz-2026-10References
Notice aws-privateca-issuer-authz-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.