AmazonAnalysisAWS patches authorization bypass in Private CA Connector for Kubernetes
What happened.Amazon Web Services published security bulletin 2026-156-AWS addressing an incorrect authorization defect in its Private CA Connector for Kubernetes.
Why it matters.Kubernetes certificate automation controllers manage identity credentials across shared enterprise infrastructure. When namespace isolation barriers fail during issuer evaluation, untrusted workloads obtain elevated cryptographic trust across the cluster. Infrastructure engineers should audit all ingress annotations and cert-manager definitions to declare explicit issuer kinds. Platform administrators must deploy the patched controller immediately across all production clusters.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-119115, a flaw in issuer resolution logic enables authenticated clients with namespace permissions to request certificates signed by cluster-scoped authorities.
- Exploitation path: An attacker submits requests omitting explicit issuer kind metadata, tricking the controller into signing unauthorized certificates via higher-privilege internal certificate authorities.
- Remediation releases: AWS released patched controller release v1.10.1 and EKS add-on v1.10.1-eksbuild.1, requiring administrators to audit issuer kind fields before deployment.