Threats affecting pkg:github/cert-manager/aws-privateca-issuer

CVE-2026-119115 is an incorrect authorization vulnerability in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before version 1.10.1. It allows an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. The issue is fixed in version 1.10.1 and the corresponding EKS add-on version 1.10.1-eksbuild.1. Users must upgrade and ensure issuerRef.kind fields are correctly set to AWSPCAIssuer or AWSPCAClusterIssuer to match the referenced issuer.