Releases

v1.19.6 is a security patch fixing a HIGH severity RBAC privilege escalation in the cert-manager-edit ClusterRole that let users create ACME Challenge and Order resources directly, plus a Go toolchain update closing three CVEs. The RBAC fix includes a documented breaking permission change.

• securityRBAC privilege escalation via ACME Challenge/Order creation

  Applies to v1.19.6: the default cert-manager-edit aggregate ClusterRole previously let namespace users create ACME Challenge and Order resources directly, bypassing Issuer solver selectors. This is fixed by removing create for challenges.acme.cert-manager.io and create/patch/update for orders.acme.cert-manager.io from that role. Upgrade to v1.19.6 to close this HIGH severity RBAC gap (GHSA-8rvj-mm4h-c258).

• securityGo toolchain updated to 1.25.11 for three CVEs

  Applies unconditionally in v1.19.6: Go is updated to 1.25.11, fixing CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507. No action needed beyond upgrading.

• breakingcert-manager-edit ClusterRole loses Challenge/Order create permissions

  If any tooling or workflow creates Challenge or Order resources directly, outside the normal Certificate to CertificateRequest to Order to Challenge flow, it will lose that access after upgrading and needs those permissions granted explicitly.

v1.20.3 is a security release primarily addressing a HIGH-severity RBAC over-permission (GHSA-8rvj-mm4h-c258) in the cert-manager-edit ClusterRole, and updating Go to v1.26.4 for three CVEs. Operators should audit any workflows that create Challenge or Order resources directly before upgrading, as those permissions are now removed.

• securityRBAC over-permission in cert-manager-edit ClusterRole (GHSA-8rvj-mm4h-c258)

  GHSA-8rvj-mm4h-c258 (HIGH): the cert-manager-edit aggregate ClusterRole previously allowed namespace users to create Challenge and Order resources directly, bypassing Issuer solver selectors. Fixed in v1.20.3. Upgrade immediately if untrusted namespace users exist in your cluster.

• securityGo runtime updated to v1.26.4 (3 CVEs)

  Go updated to v1.26.4, patching CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507. No additional configuration is required; upgrading cert-manager picks up the fix.

• breakingBreaking RBAC change: direct Challenge and Order creation removed from cert-manager-edit

  cert-manager-edit no longer grants create on challenges.acme.cert-manager.io, or create/patch/update on orders.acme.cert-manager.io. If any tooling or CI workflow creates Challenge or Order objects directly (outside the normal Certificate → CertificateRequest → Order → Challenge flow), those calls will fail after upgrading. Review and update any such automation before rolling out v1.20.3.

Pure security patch: Go runtime bumped to 1.23.9 and vulnerable dependencies updated. No functional changes — upgrade is the only action needed.

• securityUpgrade to v1.19.5 immediately — this is a pure CVE fix

  The cert-manager team explicitly recommends all users upgrade. The changes are limited to Go runtime and dependency bumps, so there is no functional risk in upgrading. If you are on any v1.19.x release, this is a straight swap with no migration steps. Check your deployment method (Helm, static manifests, OperatorHub) and roll it out to all clusters. Delaying leaves your cert-manager pods running with known vulnerable Go packages.

Patch release fixing a Helm chart YAML generation bug when webhook.config and webhook.volumes are both set, plus Go 1.26.2 upgrade to address dependency vulnerabilities.

• securityDependency vulnerabilities patched — upgrade to get the fixes

  The Go runtime and dependencies were bumped specifically to address reported CVEs. The release notes don't call out specific CVE IDs, but don't let that slow you down — cert-manager sits in a privileged position in your cluster handling certificate issuance, so keeping it current on security patches is non-negotiable. Schedule an upgrade in your next maintenance window.

• breakingUpgrade immediately if you use both webhook.config and webhook.volumes

  If your Helm values set both webhook.config and webhook.volumes, the chart has been generating invalid YAML — meaning your webhook may have silently deployed with incorrect configuration. Upgrade to v1.20.2 and redeploy, then verify the webhook pod is running with the expected volume mounts and config.

v1.20.1 is a targeted patch fixing an OpenShift upgrade blocker, a Gateway API duplicate parentRef bug, and a scanner-flagged gRPC dependency bump.

• securitygRPC bump is cosmetic — but clear your scanner alerts

  The gRPC dependency was bumped purely to satisfy vulnerability scanners. The reported CVE does not affect cert-manager's code paths. No runtime risk, but if your supply chain tooling (Trivy, Grype, etc.) was flagging v1.20.0, this update will resolve those alerts. Good reason to upgrade, but no urgency beyond scanner hygiene.

• breakingOpenShift users: upgrade to v1.20.1, skip v1.20.0

  v1.20.0 introduced a regression where the order controller lacked the necessary finalizer RBAC, breaking upgrades on OpenShift due to stricter RBAC enforcement. If you're on OpenShift and held back from v1.20.0, go straight to v1.20.1. If you somehow applied v1.20.0, verify that the ClusterRole for the order controller now includes the issuer finalizer permissions after upgrading.

• enhancementGateway API users: fix parentRef duplication before it causes routing issues

  If you're using Gateway API integration with cert-manager and specify parent references in both the issuer config and via annotations, v1.20.0 would generate duplicate parentRef entries. This can cause unpredictable behavior depending on your gateway implementation. Upgrading to v1.20.1 resolves this — review any existing certificates using both mechanisms to confirm they're clean post-upgrade.

cert-manager v1.20.0 introduces Gateway API ListenerSet support, Azure Private DNS integration, and promotes OtherNames to Beta, while fixing several ACME and DNS-related bugs.

• securityUpdate for DNS DoS vulnerability fix

  A moderate security issue allowed attackers to cause controller denial-of-service through malformed DNS responses. Update immediately if your cert-manager controllers are exposed to untrusted DNS servers or networks where DNS traffic could be manipulated.

• breakingContainer UID/GID changes affect security contexts

  Default container user changed from UID 1000 to 65532, and group from GID 0 to 65532. Review your pod security policies, security contexts, and file permissions if you've hardcoded these values or rely on root group access.

• enhancementEnable Azure Private DNS for internal certificate management

  New Azure Private DNS support allows DNS-01 challenges for private zones. Configure your Azure DNS issuer with private zone settings to manage certificates for internal services without exposing DNS records publicly.

cert-manager v1.18.6 is a security-focused patch release primarily addressing CVE-2025-68121 through Go runtime updates, with no functional changes to certificate management operations.

• securityUpdate to v1.18.6 for CVE-2025-68121 mitigation

  This release patches a Go runtime vulnerability (CVE-2025-68121) that could affect cert-manager security. Plan an upgrade within your standard maintenance window as this is a drop-in replacement with no configuration changes required. Test in non-production first, then roll out to production clusters.

• enhancementSafe upgrade path for production workloads

  Since this is purely a security patch with no functional changes, you can upgrade with confidence using your existing deployment processes. The update maintains full backward compatibility, making it suitable for automated deployment pipelines without additional testing overhead.