The cert-manager Operator for Red Hat OpenShift (versions >=1.18.0 <=1.18.1) is affected by a vulnerability in the Go standard library's crypto/x509 package (CVE-2025-61727). This vulnerability arises because the certificate validation logic does not properly restrict wildcard SANs in leaf certificates when an excluded DNS name constraint is present in the certificate chain. An attacker who obtains a leaf certificate with a wildcard SAN can bypass the intended domain restrictions, causing the application to accept certificates that should be rejected. This flaw can lead to man-in-the-middle attacks by spoofing trusted entities. Red Hat classifies this issue as moderate severity and notes that no effective mitigation or patch currently meets their criteria for deployment. The vulnerability is part of a set of related CVEs addressed in Red Hat Advisory RHSA-2026:1042, but no fixes have been released for this specific issue as of the advisory date.

The vulnerability allows attackers to bypass certificate validation checks, potentially enabling man-in-the-middle attacks by presenting malicious certificates that are incorrectly accepted as valid. This can lead to spoofing of trusted hosts and interception or modification of data in transit. However, the attacker does not gain full control over all data read or modified during the attack. The impact is rated moderate by Red Hat, reflecting the potential for partial compromise of confidentiality and integrity in communications relying on the vulnerable certificate validation.

No official patch or fix is currently available for this vulnerability that meets Red Hat's criteria for ease of use, deployment, and stability. Users should ensure all previously released errata are applied. For cert-manager Operator installations with the default 'Automatic' approval policy, upgrades will be applied automatically when available. For 'Manual' approval policy, administrators must manually approve upgrades. Users should monitor Red Hat advisories for future fixes and consider mitigating exposure by restricting trust boundaries or certificate issuance policies where possible. Consulting Red Hat support or a Technical Account Manager may provide additional guidance.