The cert‑manager controller performs DNS lookups for ACME DNS‑01 challenges using standard unencrypted DNS. An attacker who can intercept and modify DNS responses can inject a specially crafted entry into the controller’s cache. When the controller later accesses the entry, it panics, causing a denial of service that stops all certificate issuance and renewal processes. This can bring down the certificates used by services in the cluster, potentially interrupting TLS‑protected applications.

The vulnerability affects cert‑manager versions 1.18.0 through 1.18.4 and 1.19.0 through 1.19.2. The affected product is the cert‑manager controller component that runs inside Kubernetes clusters. Any cluster running these versions is at risk if its DNS traffic can be observed or controlled by an attacker, or if the authoritative DNS server for the domain used in the challenge is malicious.

The CVSS base score of 5.9 indicates a moderate severity. The EPSS score is less than 1%, meaning the probability of exploitation in the wild is very low, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires network access to the controller pod’s DNS traffic or control of the authoritative DNS server for the target domain; both conditions can exist in many environments. Because the failure results in a controller panic rather than full host compromise, the attack vector is limited to denial of service. Nonetheless, timely patching is warranted to avoid service disruption.