cert-manager v1.19.6

A critical security-focused patch release that mitigates a privilege escalation vector in ACME workflows by tightening default RBAC permissions and updating the Go runtime to address recent CVEs.

Security Patch for ACME Challenge and Order Access Control — This fixes a high-severity vulnerability where restricted users could potentially bypass issuer selector logic to leak DNS credentials. Upgrading ensures that your ACME credentials remain secure even if a namespace-level user is compromised.

Restrictive Updates to cert-manager-edit ClusterRole Permissions — The cert-manager-edit role is now more restrictive to prevent security bypasses. If your CI/CD pipelines or custom scripts manually manipulate Challenge or Order resources instead of letting cert-manager handle them, those workflows will fail until permissions are manually adjusted.

Go Runtime and Dependency Security Bumps — The core cert-manager binaries are now built with the latest Go versions to mitigate known vulnerabilities (CVE-2026-27145, CVE-2026-42504, CVE-2026-42507) in the Go runtime and standard library, reducing the overall attack surface of your cluster infrastructure.