{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aws-private-ca-connector-for-kubernetes-before-v1.10.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-119115"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS Private CA Connector for Kubernetes (before v1.10.1)","aws-privateca-issuer (before v1.10.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 contains an incorrect authorization vulnerability in the issuer resolution logic. This may allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.\u003c/p\u003e\n\u003cp\u003eTo remediate, users should upgrade aws-privateca-issuer to v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to v1.10.1-eksbuild.1. Users must also update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, as v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer.\u003c/p\u003e\n","date_modified":"2026-10-29T17:53:28Z","date_published":"2026-10-29T17:53:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aws-privateca-auth/","summary":"An incorrect authorization vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates, including subordinate CA certificates, that their approval policy does not authorize.","title":"Amazon AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution (CVE-2026-119115)","url":"https://feed.craftedsignal.io/briefs/2026-10-aws-privateca-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - AWS Private CA Connector for Kubernetes (Before V1.10.1)","version":"https://jsonfeed.org/version/1.1"}