The cert-manager Operator for Red Hat OpenShift extends Kubernetes by managing certificate authorities and certificates as API resources. Multiple CVEs affect versions 1.18.0 through 1.18.1, including CVE-2025-61727, which is a flaw in the Go standard library's crypto/x509 package. This flaw allows certificate validation bypass via excluded subdomain constraints not restricting wildcard SANs in leaf certificates. An attacker with a wildcard SAN leaf certificate can exploit this to bypass validation and potentially perform man-in-the-middle attacks. Red Hat rates this vulnerability as moderate in severity but the overall advisory rates the set of vulnerabilities as high severity. No known exploits in the wild have been reported. The advisory does not list any fixed versions or patches but notes that automatic operator upgrades will apply the fix if enabled.

An attacker who obtains a leaf certificate with a wildcard SAN can bypass certificate validation constraints that exclude certain subdomains, allowing them to impersonate trusted hosts within the Kubernetes cluster. This can lead to man-in-the-middle attacks where the attacker intercepts or modifies communications. The impact includes potential spoofing of trusted entities and unauthorized access to sensitive data. However, the attacker does not gain full control over all data, limiting the scope of the attack. The vulnerabilities affect the integrity and authentication mechanisms of the cert-manager Operator environment.

Red Hat does not currently provide a direct patch for these vulnerabilities in the cert-manager Operator for OpenShift 1.18.0 through 1.18.1. However, if the operator's installation uses the default 'Automatic' approval policy, upgrades to fixed operator versions will be applied automatically. For installations with 'Manual' approval policy, administrators must manually approve the operator upgrade to receive the fix. Users should ensure all previously released errata are applied before upgrading. Monitoring Red Hat advisories for updates and following the official upgrade instructions at https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html is recommended.