Amazon AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution (CVE-2026-119115)
An incorrect authorization vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates, including subordinate CA certificates, that their approval policy does not authorize.
CVE search metadata
CVE search record: CVE-2026-119115. Severity: high. CVSS: 8.5. KEV: no. Product: AWS Private CA Connector for Kubernetes (before v1.10.1), aws-privateca-issuer (before v1.10.1). Brief: Amazon AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution (CVE-2026-119115). Brief link: https://feed.craftedsignal.io/briefs/2026-10-aws-privateca-auth/
Triage facts
Revision 1- Applicability
- AWS Private CA Connector for Kubernetes (before v1.10.1), aws-privateca-issuer (before v1.10.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 17:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 contains an incorrect authorization vulnerability in the issuer resolution logic. This may allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.
To remediate, users should upgrade aws-privateca-issuer to v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to v1.10.1-eksbuild.1. Users must also update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, as v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer.