Vendor

smallstep

4 known vulnerabilities.

Products

certificates 3 Step-CA 1

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 10.0

CVE-2026-30836

Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.…

smallstep certificates github.com/smallstep/certificates step-certificates Ubuntu Alpine Go

Mar 19, 2026
Critical 10.0

CVE-2025-44005

Step CA Has Authorization Bypass in ACME and SCEP Provisioners

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

smallstep Step-CA github.com/smallstep/certificates step-certificates Alpine Go

Dec 17, 2025