# cert-manager v1.20.5

> Security · 2026-10-28

A security maintenance release that removes trust in compromised certificate authorities and updates vulnerable Go and OpenTelemetry dependencies. Source builds now require Go 1.26, including Go 1.26.10 for fixes across standard-library packages.

## Action needed
- **[security · critical]** `golang.org/x/net` HTTP/2 fixes
  - `golang.org/x/net` is updated to v0.60.0 to fix CVE-2026-78669, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, and CVE-2026-97032 in HTTP/2.
- **[security · high]** `github.com/go-jose/go-jose/v4` updated to v4.1.6
  - `github.com/go-jose/go-jose/v4` is updated to v4.1.6 to fix CVE-2026-116587 and GHSA-mgcc-cww5-fp2q, a denial of service when parsing JWKs containing RSA keys.
- **[security · high]** `golang.org/x/crypto` updated to v0.57.0
  - `golang.org/x/crypto` is updated to v0.57.0 to fix CVE-2026-56855 and CVE-2026-78662.
- **[security]** `crypto/x509` certificate-chain rejection
  - `crypto/x509` now rejects certificate chains that pass through compromised intermediates. This behavior ships with Go 1.26.10 and addresses CVE-2026-111943 and GO-2026-6809.
- **[security]** Trust in compromised certificate authority roots removed
  - The base images now use Debian 13, which no longer trusts the compromised `emSign ECC Root CA - G3` and `AAA Certificate Services` roots.
- **[security]** `Go` 1.26.10 security update
  - `Go` is updated to 1.26.10, which fixes issues in the `crypto/tls`, `crypto/x509`, `net/http`, `net/textproto`, `mime/multipart`, and `html/template` packages.
- **[security]** OpenTelemetry OTLP trace exporters updated to v1.45.0
  - `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and `otlptracegrpc` are updated to v1.45.0 to fix a reported security vulnerability.
- **[security]** `golang.org/x/net` `html` package fixes
  - `golang.org/x/net` is updated to v0.62.0 to fix CVE-2026-78661 and CVE-2026-97045 in the `html` package.
- **[breaking]** The `go` directive, raised to 1.26
  - The `go` directive in cert-manager's `go.mod` files is now 1.26. Source builds use the Go 1.26 toolchain requirement.

[Full analysis](https://ratatosk.io/en/releases/cert-manager/v1.20.5)

[Original release notes](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.5)