Skip to content
OpenAdvisories

Vendor

smallstep

4 known vulnerabilities.

Products

certificates 3 Step-CA 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-40097

    Step CA affected by an index out of bounds panic in TPM attestation EKU validation

    Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an…

    smallstep certificates github.com/smallstep/certificates Go