cert-manager v1.20.3

This critical security patch addresses a high-severity vulnerability (GHSA-8rvj-mm4h-c258) related to unauthorized ACME resource manipulation, which could lead to credential disclosure. It also improves cluster hygiene by fixing a bug in Challenge garbage collection and includes vital security updates for the Go runtime.

Fix high-severity ACME credential disclosure vulnerability — This fix addresses a high-severity vulnerability where unprivileged users could potentially leak DNS credentials or bypass DNS zone restrictions by manually creating ACME Challenge resources. It ensures that sensitive Issuer credentials remain protected within their designated namespaces.

Restrict RBAC permissions for ACME Challenges and Orders — To close the security loophole mentioned above, users can no longer manually create Challenges or Orders using the default edit role. If you use custom scripts that bypass the standard Certificate object to trigger ACME flows, you must manually update your RBAC policies.

Fix ACME Challenge resource leaking and garbage collection — Resolves an issue where old ACME Challenge resources were not being correctly deleted by Kubernetes garbage collection. This prevents resource accumulation and potential performance degradation in clusters with high certificate churn.

Update Go and dependencies to address multiple CVEs — By moving to Go 1.26.4, the release mitigates several upstream vulnerabilities, ensuring the cert-manager binary itself remains compliant with modern security standards and toolchains.