CVE-2026-119115— Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

Quick assessment

Affected

AWS aws-privateca-issuer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 AWS Private CA Connector for Kubernetes（aws-privateca-issuer）v1.10.1 之前版本中，发行者解析逻辑存在授权验证缺陷。该漏洞可能允许已认证的远程用户获取由集群范围的 AWS Private CA 发行者签发的证书（包括从属 CA 证书），即使其审批策略并未授权该用户获取此类证书。为修复此问题，用户应将 aws-privateca-issuer 升级至 v1.10.1 版本，或将 AWS Private CA Connector for Kuber

CVSS 8.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1583 · Acquire Infrastructure T1603

Affected Version Matrix 2

Vendor	Product	Version Range	Status
AWS	aws-privateca-issuer	`< 1.10.1`	affected
		`< 1.10.1-eksbuild.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

Source: CVE Program / CVE List V5

Vulnerability Description

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AWS	aws-privateca-issuer	0 ~ 1.10.1	-
AWS	aws-privateca-issuer	0 ~ 1.10.1-eksbuild.1	-

II. Public POCs for CVE-2026-119115

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119115

请登录查看更多情报信息。

Other References for CVE-2026-119115 (3)

https://github.com/cert-manager/aws-privateca-issuer/releases/tag/v1.10.1 release-notes patch
https://aws.amazon.com/security/security-bulletins/2026-156-aws/ vendor-advisory
https://github.com/cert-manager/aws-privateca-issuer/security/advisories/GHSA-hjrh-q6pg-mh82 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119115

IV. Related Vulnerabilities

Same vendor: AWS

Same weakness: CWE-863