The vulnerability is a denial of authorization through user‑controlled keys (CWE‑863). Attackers can create ACME Challenge resources in the acme.cert‑manager.io API without an associated Order or Issuer, making cert‑manager resolve the Challenge against a ClusterIssuer defined in the cluster. This bypasses the DNS01 solver policy selectors, allowing attackers to apply DNS credentials they control, inject arbitrary DNS records, and exfiltrate sensitive acme‑dns API keys such as X‑Api‑User and X‑Api‑Key. The primary impact is unauthorized certificate issuance and modification of DNS records, compromising both integrity and confidentiality of the managed domain.

cert‑manager versions 1.18.0 through 1.19.5, and 1.20.0 through 1.20.2 are affected. The issue is resolved in 1.19.6 and later releases, including 1.20.3 and newer.

The CVSS score of 7.3 indicates a high impact, but the EPSS of less than 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no known active exploits have been reported. An attacker who can create Kubernetes resources in a namespace with sufficient privileges can trigger the exploit by submitting a custom Challenge resource that points to a ClusterIssuer. Because the mechanism relies on cluster‑wide credentials, a successful attack can expose sensitive API keys and alter DNS entries, leading to domain takeover or mitigation of TLS operations.