AWS Private CA Connector 1.10.1 Fixes Issuer Authorization
Tech GuruQuick Answer
AWS bulletin 2026-156-AWS fixes CVE-2026-119115 in Private CA Connector for Kubernetes. Inventory Helm and EKS add-on deployments, update to 1.10.1 or 1.10.1-eksbuild.1, validate approval policies and issuer scope, review unexpected certificate issuance where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory clusters using aws-privateca-issuer or the EKS add-on, exact versions, ClusterIssuer and Issuer resources, approval policies, CA hierarchy, certificate records, owners, and deployment pipelines. Confirm an affected connector version and issuer-resolution path; do not infer that cert-manager, AWS Private CA, or every Kubernetes cluster is affected without this connector. Upgrade the Helm or manifest deployment to aws-privateca-issuer 1.10.1 and the EKS add-on to 1.10.1-eksbuild.1 through the supported channel. Confirm running images and add-on versions, test namespace and cluster issuer authorization, inspect certificate requests and CA issuance for anomalies where warranted, and retain deployment and audit evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS Private CA Connector for Kubernetes and the aws-privateca-issuer cert-manager external issuer |
|---|---|
| Advisory | 2026-156-AWS |
| CVE | CVE-2026-119115 |
| Authoritative release date | 2026-10-29 16:30:00 UTC |
| Authority revision date | 2026-10-29 16:45:45 UTC |
| Affected versions | aws-privateca-issuer before 1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on before 1.10.1-eksbuild.1. |
| Fixed version | aws-privateca-issuer 1.10.1 and AWS Private CA Connector for Kubernetes EKS add-on 1.10.1-eksbuild.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS fixed issuer-resolution authorization that could let an authenticated user approved only for a namespace issuer obtain certificates, including subordinate CA certificates, from an unauthorized cluster issuer.
What To Validate Now
- Inventory. Inventory clusters using aws-privateca-issuer or the EKS add-on, exact versions, ClusterIssuer and Issuer resources, approval policies, CA hierarchy, certificate records, owners, and deployment pipelines.
- Establish applicability. Confirm an affected connector version and issuer-resolution path; do not infer that cert-manager, AWS Private CA, or every Kubernetes cluster is affected without this connector.
- Remediate. Upgrade the Helm or manifest deployment to aws-privateca-issuer 1.10.1 and the EKS add-on to 1.10.1-eksbuild.1 through the supported channel.
- Validate. Confirm running images and add-on versions, test namespace and cluster issuer authorization, inspect certificate requests and CA issuance for anomalies where warranted, and retain deployment and audit evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Certificate-authority changes can interrupt issuance and trust workflows. Preserve CA and request evidence, test renewal and revocation paths, and avoid broadening approval policy as a workaround.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
