smallstep github.com/smallstep/certificates vulnerabilities

Latest smallstep github.com/smallstep/certificates CVEs

Newest publication first

1. CVE-2026-40097 Step CA affected by an index out of bounds panic in TPM attestation EKU validation

   Published 2026-04-10

   Low·CVSS 3.7 EPSS 0.19%

   Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key U...

2. CVE-2026-30836 Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

   Published 2026-03-19

   Critical·CVSS 10.0 EPSS 0.31%

   Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

3. CVE-2025-44005 Step CA Has Authorization Bypass in ACME and SCEP Provisioners

   Published 2025-12-17

   Critical·CVSS 10.0 EPSS 9.1%

   An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

4. CVE-2025-66406 Improper Authorization Check for SSH Certificate Revocation

   Published 2025-12-03

   Medium·CVSS 5.0 EPSS 0.16%

   Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fix...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.