Bulletin ID: 2026-156-AWS
Publication Date: 10/29/2026 09:30 AM PDT
Description:
We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.
Impacted versions:
– aws-privateca-issuer before v1.10.1
– AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
This article has been indexed from Latest Bulletins