RATATOSKRATATOSK
Sign in

cert-manager

v1.21.3Security
Oct 23, 2026

ACTION 6CHECK 1OTHER 2

A security-focused maintenance release updates Go and vulnerable dependencies, removes a compromised root certificate from distroless images, and tightens certificate key handling. It also includes fixes for ACME renewal-loop behavior and Helm rendering of proxy values.

Action needed (6)

  • securitycrypto/x509 rejection of chains through compromised intermediates

    Go 1.26.10 makes crypto/x509 reject certificate chains that pass through the compromised intermediates. This addresses CVE-2026-111943 and GO-2026-6809 in the release.

    CVE-2026-111943

  • securityGo 1.26.9 and fixes in standard library packages

    The release upgrades Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto, and html/template packages.

  • securityGo 1.26.10 and the crypto/x509 package

    The release upgrades Go to 1.26.10, fixing a CVE in the crypto/x509 package.

  • securitygolang.org/x/net v0.60.0

    The golang.org/x/net dependency is updated to v0.60.0 to fix reported security vulnerabilities.

  • securityOpenTelemetry OTLP trace exporters v1.45.0

    The go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc dependencies are updated to v1.45.0 to fix a reported security vulnerability.

  • securityDistroless base images without the compromised emSign root certificate

    The distroless base images are updated with the compromised "emSign ECC Root CA - G3" root certificate removed.

Check if affected (1)

  • securityValidation of status.nextPrivateKeySecretName Secret labeling and ownership

    Applies if status.nextPrivateKeySecretName is used and the cert-manager.io/next-private-key label is set.

    The requestmanager and issuing controllers now consume the Secret named by status.nextPrivateKeySecretName only when it has the cert-manager.io/next-private-key label and is owned by the Certificate.

All 2 other recorded changesfixes 2

fixes (2)

  • - Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)
  • - Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @pujitha24)
Add cert-manager to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All cert-manager releases →