# cert-manager v1.20.4

> Security · 2026-09-16

A security-focused patch release fixes multiple dependency vulnerabilities and an ingress-shim defect. It also updates distroless base images and release-signing procedures.

## Action needed
- **[security · high]** The `golang.org/x/net`, `golang.org/x/text`, and `golang.org/x/crypto` versions
  - `golang.org/x/net` is updated to v0.58.0, `golang.org/x/text` to v0.41.0, and `golang.org/x/crypto` to v0.55.0. The updates fix CVE-2026-46600, CVE-2026-56852, and CVE-2026-56854.
- **[security · high]** The `google.golang.org/grpc` version and advisory fixes
  - `google.golang.org/grpc` is updated to v1.83.2 to fix CVE-2026-84304, CVE-2026-84445, CVE-2026-84303, GHSA-vp52-pcj8-j9qc, GHSA-2v4p-qf9q-27wj, and GHSA-hrxh-6v49-42gf.
- **[security]** The `Go` version and standard library security fixes
  - `Go` is updated to 1.26.5 and then 1.26.6. These versions include security fixes for the `go` command and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`, `net`, `net/http`, and `net/url` packages.
- **[security · medium]** The `github.com/google/cel-go` version
  - `github.com/google/cel-go` is updated to v0.30.0 to fix the reported vulnerability GHSA-gcjh-h69q-9w9g.
- **[security]** The security-scanned Go dependencies
  - `golang.org/x/mod`, `go.opentelemetry.io/otel`, and `go.etcd.io/etcd/client/pkg/v3` are updated to versions flagged by security scanners.
- **[security · medium]** The `software.sslmate.com/src/go-pkcs12` version
  - `software.sslmate.com/src/go-pkcs12` is updated to v0.7.2 to fix the reported vulnerability GHSA-mpwr-8vm7-h73f.

## Other recorded changes
- 2 (value_changed 1, defect_corrected 1)

[Full analysis](https://ratatosk.io/en/releases/cert-manager/v1.20.4)

[Original release notes](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.4)