CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
// AI summary
AWS Private CA Connector for Kubernetes has CVE-2026-119115, an incorrect authorization flaw in issuer resolution allowing authenticated users to obtain unauthorized cluster-scoped certificates before v1.10.
// from the source
Bulletin ID: 2026-156-AWS Publication Date: 10/29/2026 09:30 AM PDT Description: We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use. Impacted versions: - aws-privateca-issuer before v1.10.