RATATOSKRATATOSK
Sign in

cert-manager

v1.21.2Security
Sep 11, 2026

ACTION 6CHECK 1OTHER 12

A maintenance release focused on correctness and data-exposure fixes. It also includes security-related dependency updates and a stricter default for namespaced Vault authentication.

Action needed (6)

  • securityACME server response body limit

    ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.

  • securityChallenge.status.reason response disclosure fix

    The ACME HTTP-01 self-check no longer copies the fetched response body into Challenge.status.reason. This prevents internal response contents reached through redirects from being disclosed.

  • securityGo 1.26.6

    The release upgrades Go to 1.26.6, which includes security fixes in the Go command and several standard library packages.

  • securitygoogle.golang.org/grpc v1.83.2

    The release updates google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities.

  • securitygolang.org/x/crypto v0.56.0

    The release updates golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities.

  • breakingValidation for converted AdmissionReview requests

    Validation now also applies to equivalent-converted AdmissionReview requests on non-v1 API versions. These requests could previously bypass validation.

Check if affected (1)

  • breakingNamespaced Vault issuer ambient credentials default

    Applies if you use a namespaced Issuer with Vault AWS IAM authentication.

    A namespaced Issuer no longer authenticates to Vault for AWS IAM authentication with the cert-manager controller's ambient AWS credentials by default. Ambient credentials are used only when explicitly enabled with --issuer-ambient-credentials.

All 12 other recorded changesfixes 11 · value changes 1

fixes (11)

  • ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs.
  • De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret
  • Fix certificate renewal windows using February 29 cron schedules across non-leap century years.
  • Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields
  • Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error.
  • Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes
  • Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured.
  • Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition.
  • Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll.
  • Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted.
  • Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects

value changes (1)

  • Upgrade Go to 1.26.8.
Add cert-manager to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All cert-manager releases →