From 2a0cff03f25d1a528d7200ac64f265060d7599f8 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Thu, 25 Jun 2026 14:56:07 +0000 Subject: [PATCH] v1.20.3: patch release notes Add v1.20.3 release notes and bump cert_manager_latest_version to v1.20.3. Co-Authored-By: Claude Signed-off-by: Richard Wall --- .spelling | 1 + .../release-notes/release-notes-1.20.md | 30 +++++++++++++++++++ .../releases/upgrading/upgrading-1.19-1.20.md | 12 ++++++-- content/docs/variables.json | 2 +- 4 files changed, 41 insertions(+), 4 deletions(-) diff --git a/.spelling b/.spelling index 82172deda88..ae819b2de0e 100644 --- a/.spelling +++ b/.spelling @@ -661,6 +661,7 @@ v1.15.0. v1.20.0 v1.20.1 v1.20.2 +v1.20.3 v1alpha1 v1alpha2 v1alpha3 diff --git a/content/docs/releases/release-notes/release-notes-1.20.md b/content/docs/releases/release-notes/release-notes-1.20.md index 0f5ebf65ee9..836e71e46af 100644 --- a/content/docs/releases/release-notes/release-notes-1.20.md +++ b/content/docs/releases/release-notes/release-notes-1.20.md @@ -3,6 +3,36 @@ title: Release 1.20 description: 'cert-manager release notes: cert-manager 1.20' --- +## v1.20.3 + +This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint. + +This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs. + +All users should upgrade. + +### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole + +> ⚠️ Potentially breaking change + +The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. + +Challenge `patch` and `update` are retained because the Challenge spec is immutable after creation and users may need these verbs to remove stuck finalizers (cert-manager/cert-manager#3851, cert-manager/cert-manager#3870). + +If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. + +### Changelog since v1.20.2 + +#### Bug or Regression + +- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8940](https://github.com/cert-manager/cert-manager/pull/8940), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) +- Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/pull/8759), [`@cert-manager-bot`](https://github.com/cert-manager-bot)) + +#### Other (Cleanup or Flake) + +- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/pull/8789), [`@SgtCoDFish`](https://github.com/SgtCoDFish)) +- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.com/cert-manager/cert-manager/pull/8926), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) + ## v1.20.2 v1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config` diff --git a/content/docs/releases/upgrading/upgrading-1.19-1.20.md b/content/docs/releases/upgrading/upgrading-1.19-1.20.md index a83b0309fcb..c14864896c3 100644 --- a/content/docs/releases/upgrading/upgrading-1.19-1.20.md +++ b/content/docs/releases/upgrading/upgrading-1.19-1.20.md @@ -3,6 +3,12 @@ title: Upgrading from v1.19 to v1.20 description: 'cert-manager installation: Upgrading v1.19 to v1.20' --- -No special upgrade steps are required to upgrade from cert-manager v1.19 to -v1.20. You can follow the [regular upgrade process](../../installation/upgrade.md) -to perform the upgrade. +## Potentially Breaking: Challenge and Order RBAC restricted in `cert-manager-edit` ClusterRole + +Starting in v1.20.3, the `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. This fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)) where these permissions allowed namespace users to bypass Issuer solver selectors and abuse ClusterIssuer credentials. + +These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. + +## Next Steps + +From here on, you can follow the [regular upgrade process](../../installation/upgrade.md). diff --git a/content/docs/variables.json b/content/docs/variables.json index dc0cf4cf137..e41106acaeb 100644 --- a/content/docs/variables.json +++ b/content/docs/variables.json @@ -1,3 +1,3 @@ { - "cert_manager_latest_version": "v1.20.2" + "cert_manager_latest_version": "v1.20.3" }