CVE-2026-119115 in aws-privateca-issuer
Summary
by MITRE • 10/29/2026
Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.
To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in AWS Private CA Connector for Kubernetes prior to version 1.10.1 represents a critical failure in access control mechanisms, specifically within the logic responsible for resolving certificate issuers. This flaw allows an authenticated remote user who possesses valid credentials and limited permissions to bypass intended authorization boundaries. In typical Kubernetes environments using this connector, administrators define specific policies that restrict which users or service accounts can request certificates from particular AWS Private Certificate Authority (CA) instances. These restrictions are often scoped to ensure that sensitive subordinate CA certificates or high-value domain certificates cannot be issued by unauthorized entities. However, due to the incorrect authorization logic in the issuer resolution process, an attacker could exploit this gap to obtain certificates signed by a cluster-scoped AWS Private CA issuer even if their specific approval policy explicitly denies access to that issuer. This effectively nullifies the granular permission controls intended to protect cryptographic assets within the infrastructure.
From a technical perspective, the root cause lies in how the connector validates the reference to an issuer during certificate request processing. Prior to version 1.10.1, the system did not strictly enforce or correctly validate the kind field of the issuerRef object when resolving which AWS Private CA should sign the requested certificate. This lack of strict validation meant that a user could potentially manipulate the request structure to point towards an authorized issuer while actually triggering issuance from a different, unauthorized cluster-scoped issuer. The operational impact is severe because it compromises the integrity of the public key infrastructure managed by Kubernetes users. An attacker gaining the ability to issue subordinate CA certificates can create trusted chains for malicious domains or internal services, facilitating man-in-the-middle attacks, data exfiltration, and further lateral movement within the network. This vulnerability aligns with CWE-269, which describes Improper Privilege Escalation, as it allows a user to gain privileges they were not explicitly granted by bypassing authorization checks.
The remediation strategy requires immediate action to patch this security gap. Users must upgrade aws-privateca-issuer to version 1.10.1 or the corresponding AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1. This update introduces stricter validation logic that ensures issuer references are correctly resolved and authorized before any certificate signing operation is initiated. Additionally, it is crucial to audit existing configurations within the cluster. Administrators should review all Certificate resources, Ingress annotations, and other objects that reference an issuer via issuerRef.kind. Any configuration where this field is missing, incorrect, or does not precisely match the referenced issuer must be corrected. Starting with version 1.10.1, the system enforces that issuerRef.kind must be exactly AWSPCAIssuer for namespaced issuers or AWSPCAClusterIssuer for cluster-scoped issuers, and it must accurately correspond to the specific issuer resource being targeted. This enforcement prevents ambiguity in resolution logic and ensures that authorization policies are applied correctly against the intended target.
This incident highlights the importance of rigorous input validation and strict adherence to schema definitions in security-critical components like certificate management systems. The vulnerability demonstrates how subtle deviations in configuration or parsing logic can lead to significant privilege escalation risks, even when robust identity and access management frameworks are otherwise in place. By upgrading to the patched version and correcting any misconfigured issuer references, organizations can restore the intended security posture of their Kubernetes-based PKI infrastructure. This ensures that only authorized entities with explicit approval policies can request certificates from designated AWS Private CAs, thereby maintaining trust boundaries and preventing unauthorized certificate issuance that could compromise network security. The fix aligns with best practices for secure software development by enforcing strict type checking and authorization verification at the point of resource resolution, reducing the attack surface associated with misconfiguration or logic errors in identity management tools.