CVE-2025-66406

medium

Description

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

References

https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201014

Details

Source: Mitre, NVD

Published: 2025-12-03

Updated: 2026-04-15

Named Vulnerability: GO-2025-4181Named Vulnerability: GHSA-j7c9-79x7-8hpr

Risk Information

CVSS v2

Base Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:M/C:N/I:P/A:C

Severity: Medium

CVSS v3

Base Score: 5

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Severity: Medium

EPSS

EPSS: 0.00151