CVE-2026-119115 Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119115?
CVE-2026-119115 is a high-severity vulnerability in aws-privateca-issuer, published on 29 Oct 2026.
Official description
Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.
To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.
Weakness: CWE-863
Which versions are affected by CVE-2026-119115?
How do I fix CVE-2026-119115?
No fix has been published for CVE-2026-119115 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119115 being exploited?
There is no known exploitation of CVE-2026-119115 in the wild and no public exploit code.
Sources
Also known as GHSA-hjrh-q6pg-mh82.