A logic flaw in the issuer resolution of AWS Private CA Connector for Kubernetes permits an authenticated remote user to obtain certificates—potentially including subordinate CA certificates—signed by a cluster‑scoped issuer that the user’s approval policy should not authorize. The result is that the attacker could generate valid certificates for the cluster, enabling domain impersonation, session hijacking, or other attacks that compromise confidentiality and integrity within the Kubernetes environment.

The vulnerability affects the aws-privateca-issuer component of AWS Private CA Connector for Kubernetes before version v1.10.1, including the EKS add‑on build v1.10.1‑eksbuild.1. The issue arises when certificate requests reference issuers whose kind or scope does not match the approval policy, and it applies to any Kubernetes cluster running the affected aws-privateca-issuer deployment.

The CVSS score of 8.4 indicates high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated user who can create or modify cert‑manager Certificate resources or Ingress annotations. The attacker needs valid Kubernetes credentials and the ability to submit certificate requests that resolve to a cluster‑scoped issuer. Once the flaw is exploited, the user can receive any certificate it is permitted to issue, including intermediate CAs, thereby escalating privileges within the cluster.