https://feed.craftedsignal.io/products/aws-privateca-issuer-before-v1.10.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:53:28 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-aws-privateca-auth/Thu, 29 Oct 2026 17:53:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-aws-privateca-auth/An incorrect authorization vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates, including subordinate CA certificates, that their approval policy does not authorize.<p>AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 contains an incorrect authorization vulnerability in the issuer resolution logic. This may allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.</p> <p>To remediate, users should upgrade aws-privateca-issuer to v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to v1.10.1-eksbuild.1. Users must also update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, as v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer.</p> highadvisory