What cert-manager/cert-manager shipped
Written by FoxPlug from public releases; not affiliated with Cert-manager. An automatic summary of the public release, pull request and commit data of github.com/cert-manager/cert-manager. Cert-manager did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 14, 2026
What shipped
- Fixed a security issue where writing to a Certificate's status subresource allowed obtaining private keys from any TLS Secret in the namespace by pointing status.nextPrivateKeySecretName at an unowned Secret. Pull request #9224
- Backported fix to v1.21.3 ensuring cert-manager only consumes private key Secrets owned by the Certificate resource. Pull request #9368
- Backported ACME ARI certificate ID status fix to v1.21.2. Pull request #9292
- Released v1.20.4 with Go and dependency updates for security vulnerabilities and a fix for ingress-shim removing applyset labels from cached Ingress and Gateway objects. Release
- Fixed elliptic curve parameter parsing with added unit tests. Pull request #9294
- Improved error wrapping across 13 files to use %w format specifier instead of %s, enabling proper error chain inspection with errors.Is() and errors.As(). Pull request #9079
- Added test coverage for Helm chart PodMonitor metrics selector values and container port configurations. Pull request #9367
- Fixed flaking Certificate foreground deletion e2e tests. Pull request #9256
- Replaced reflect.DeepEqual usage in tests with more readable assertion patterns for better test failure output. Pull request #9333
Why it matters
This week includes a security fix for private key access control in Certificate status subresources, critical patches backported to maintenance branches, and improvements to error handling and test quality. These changes improve both the security posture and maintainability of cert-manager for production deployments.
Changelog entry
- Security: Fixed unauthorized private key access through Certificate status.nextPrivateKeySecretName by restricting consumption to Secrets owned by the Certificate Pull request #9224
- v1.20.4: Updated Go and dependencies for security fixes; fixed ingress-shim applyset label removal from cached Ingress and Gateway objects Release
- Fixed elliptic curve parameter parsing with unit tests Pull request #9294
- Improved error wrapping to use %w format specifier for proper error chain handling Pull request #9079
- Fixed flaking Certificate foreground deletion e2e tests Pull request #9256
cert-manager updates: security fix for Certificate status subresource access, v1.20.4 released with dependency updates, elliptic curve parsing fixed, and improved error handling throughout the codebase.
This week's cert-manager updates address a security vulnerability in Certificate status subresource access control, release v1.20.4 with important security dependency updates and ingress-shim fixes, backports of ARI and private key ownership checks to maintenance branches, fixes for elliptic curve parameter parsing, and code quality improvements including better error wrapping and test assertions.