smallstep

4 results · Feed

• Low 3.7
  CVE-2026-40097

  Step CA affected by an index out of bounds panic in TPM attestation EKU validation

  Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an…

  smallstep certificates github.com/smallstep/certificates Go
  Apr 10, 2026
• Critical 10.0
  CVE-2026-30836

  Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

  Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.…

  smallstep certificates github.com/smallstep/certificates step-certificates Ubuntu Alpine Go
  Mar 19, 2026
• Critical 10.0
  CVE-2025-44005

  Step CA Has Authorization Bypass in ACME and SCEP Provisioners

  An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

  smallstep Step-CA github.com/smallstep/certificates step-certificates Alpine Go
  Dec 17, 2025
• Medium 5.0
  CVE-2025-66406

  Improper Authorization Check for SSH Certificate Revocation

  Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This…

  smallstep certificates github.com/smallstep/certificates step-certificates Alpine Go
  Dec 3, 2025