# cert-manager v1.21.3

> Security · 2026-10-23

A security-focused maintenance release updates Go and vulnerable dependencies, removes a compromised root certificate from distroless images, and tightens certificate key handling. It also includes fixes for ACME renewal-loop behavior and Helm rendering of proxy values.

## Action needed
- **[security]** `crypto/x509` rejection of chains through compromised intermediates
  - `Go` 1.26.10 makes `crypto/x509` reject certificate chains that pass through the compromised intermediates. This addresses CVE-2026-111943 and GO-2026-6809 in the release.
- **[security]** `Go` 1.26.9 and fixes in standard library packages
  - The release upgrades `Go` to 1.26.9, fixing CVEs in the `crypto/tls`, `net/http`, `net/textproto`, and `html/template` packages.
- **[security]** `Go` 1.26.10 and the `crypto/x509` package
  - The release upgrades `Go` to 1.26.10, fixing a CVE in the `crypto/x509` package.
- **[security]** `golang.org/x/net` v0.60.0
  - The `golang.org/x/net` dependency is updated to v0.60.0 to fix reported security vulnerabilities.
- **[security]** OpenTelemetry OTLP trace exporters v1.45.0
  - The `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and `otlptracegrpc` dependencies are updated to v1.45.0 to fix a reported security vulnerability.
- **[security]** Distroless base images without the compromised emSign root certificate
  - The distroless base images are updated with the compromised "emSign ECC Root CA - G3" root certificate removed.

## Check if affected
- **[security]** Validation of `status.nextPrivateKeySecretName` Secret labeling and ownership
  - Applies if `status.nextPrivateKeySecretName` is used and the `cert-manager.io/next-private-key` label is set.
  - The `requestmanager` and `issuing` controllers now consume the Secret named by `status.nextPrivateKeySecretName` only when it has the `cert-manager.io/next-private-key` label and is owned by the Certificate.

## Other recorded changes
- 2 (defect_corrected 2)

[Full analysis](https://ratatosk.io/en/releases/cert-manager/v1.21.3)

[Original release notes](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.3)