CVE-2026-25518
📋 TL;DR
This vulnerability in cert-manager allows attackers to cause denial-of-service by poisoning DNS caches during ACME DNS-01 challenge processing. Attackers who can intercept DNS traffic or control authoritative DNS servers can trigger a panic in the cert-manager controller. Organizations running affected cert-manager versions in Kubernetes clusters are vulnerable.
💻 Affected Systems
- cert-manager
📦 What is this software?
Cert Manager by Cert Manager
Cert Manager by Cert Manager
⚠️ Risk & Real-World Impact
Worst Case
Complete denial-of-service of cert-manager controller, preventing certificate issuance and renewal across the entire Kubernetes cluster, potentially causing service disruptions as certificates expire.
Likely Case
Temporary cert-manager controller crashes requiring pod restarts, causing delays in certificate issuance and renewal operations.
If Mitigated
Minimal impact with proper network segmentation and DNS security controls preventing DNS interception.
🎯 Exploit Status
Exploitation requires ability to intercept DNS traffic or control authoritative DNS servers for domains being validated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.5, 1.19.3
Vendor Advisory: https://github.com/cert-manager/cert-manager/security/advisories
Restart Required: Yes
Instructions:
1. Backup cert-manager configurations. 2. Update cert-manager using Helm: 'helm upgrade cert-manager jetstack/cert-manager --version 1.18.5' or '--version 1.19.3'. 3. Verify all cert-manager pods restart successfully. 4. Test certificate issuance.
🔧 Temporary Workarounds
Use HTTP-01 challenges
allSwitch from DNS-01 to HTTP-01 ACME challenges where possible
kubectl edit issuer <issuer-name>
Change solver type from DNS01 to HTTP01
Configure DNS over TLS
allConfigure cert-manager to use DNS over TLS for DNS lookups
Add 'dns01:' section with 'cnameStrategy: Follow' and configure DNS server with TLS support
🧯 If You Can't Patch
- Implement network segmentation to protect cert-manager pod DNS traffic
- Use dedicated, secured DNS servers for cert-manager with DNSSEC validation
🔍 How to Verify
Check if Vulnerable:
Check cert-manager version: 'kubectl get deployment cert-manager -o jsonpath="{.spec.template.spec.containers[0].image}"' and verify if version is between 1.18.0-1.18.4 or 1.19.0-1.19.2Check Version:
kubectl get deployment cert-manager -o jsonpath="{.spec.template.spec.containers[0].image}" | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Verify cert-manager version is 1.18.5 or 1.19.3 or higher, and test DNS-01 certificate issuance📡 Detection & Monitoring
Log Indicators:
- cert-manager-controller pod crashes/restarts
- Panic logs in cert-manager controller
- DNS lookup errors during certificate issuance
Network Indicators:
- Unusual DNS traffic patterns to/from cert-manager pods
- DNS responses with malformed data to cert-manager
SIEM Query:
source="cert-manager" AND ("panic" OR "fatal" OR "crash")🔗 References
- https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc
- https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d
- https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2
- https://github.com/cert-manager/cert-manager/pull/8467
- https://github.com/cert-manager/cert-manager/pull/8468
- https://github.com/cert-manager/cert-manager/pull/8469
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv
