cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release updates Go and several dependencies to fix reported security vulnerabilities, and fixes a bug where ingress-shim removed the applyset label from cached Ingress and Gateway objects.
All users should upgrade.
Note
Security scanners still report three golang.org/x/crypto findings. None of them affects cert-manager and we do not plan to fix them in the 1.20 line.
- CVE-2026-56855 and CVE-2026-78662 are deadlocks in the
golang.org/x/crypto/sshconnection multiplexer, triggered by a malicious SSH peer after a connection is established. cert-manager never opens an SSH connection. Only the controller links thesshpackage, throughvcert, which uses it to format a public key. The fix,golang.org/x/cryptov0.56.0, requires Go language version 1.26, which we will not adopt in a patch release.govulncheckconfirms the vulnerable functions are not called. - GO-2026-5932 marks
golang.org/x/crypto/openpgpas unmaintained. cert-manager does not import that package and there is no fixed version.
cert-manager 1.21 already uses golang.org/x/crypto v0.56.0, so upgrade to 1.21 if you need a clean scan.
Changes by Kind
Bug or Regression
- Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9315, @KR-Ravindra)
Other (Cleanup or Flake)
- Update Go to 1.26.5 and then 1.26.6, which include security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages (#8995, @wallrj-cyberark; #9152, @wallrj)
- Bump
golang.org/x/netto v0.58.0,golang.org/x/textto v0.41.0 andgolang.org/x/cryptoto v0.55.0 to fix CVE-2026-46600, CVE-2026-56852 and CVE-2026-56854 (#9040, @wallrj-cyberark) - Bump
google.golang.org/grpcto v1.83.2 to fix CVE-2026-84304, CVE-2026-84445, CVE-2026-84303 and one further advisory (#9062, #9257, #9316) - Bump
github.com/google/cel-goto v0.30.0 to fix a reported vulnerability (#9070, #9186) - Bump
software.sslmate.com/src/go-pkcs12to v0.7.2 to fix a reported vulnerability (#8988) - Bump
golang.org/x/mod,go.opentelemetry.io/otelandgo.etcd.io/etcd/client/pkg/v3to versions flagged by security scanners (#9143, #9071, #9185) - Update the distroless base images (#8991, #9024, #9055, #9325)
- The release staging process now signs
metadata.jsonwith cosign so the publish step can verify its authenticity (#9090, @FelixPhipps)