# cert-manager v1.21.2

> Security · 2026-09-11

A maintenance release focused on correctness and data-exposure fixes. It also includes security-related dependency updates and a stricter default for namespaced Vault authentication.

## Action needed
- **[security]** ACME server response body limit
  - ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.
- **[security]** `Challenge.status.reason` response disclosure fix
  - The ACME HTTP-01 self-check no longer copies the fetched response body into `Challenge.status.reason`. This prevents internal response contents reached through redirects from being disclosed.
- **[security]** `Go` 1.26.6
  - The release upgrades `Go` to 1.26.6, which includes security fixes in the `Go` command and several standard library packages.
- **[security]** `google.golang.org/grpc` v1.83.2
  - The release updates `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities.
- **[security]** `golang.org/x/crypto` v0.56.0
  - The release updates `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities.
- **[breaking]** Validation for converted `AdmissionReview` requests
  - Validation now also applies to equivalent-converted `AdmissionReview` requests on non-v1 API versions. These requests could previously bypass validation.

## Check if affected
- **[breaking]** Namespaced Vault issuer ambient credentials default
  - Applies if you use a namespaced `Issuer` with Vault AWS IAM authentication.
  - A namespaced `Issuer` no longer authenticates to Vault for AWS IAM authentication with the cert-manager controller's ambient AWS credentials by default. Ambient credentials are used only when explicitly enabled with `--issuer-ambient-credentials`.

## Other recorded changes
- 12 (defect_corrected 11, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cert-manager/v1.21.2)

[Original release notes](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2)