CVE-2026-30836

critical

Description

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

References

https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw

https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7

https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13200

Details

Source: Mitre, NVD

Published: 2026-03-19

Updated: 2026-04-27

Named Vulnerability: GO-2026-4775Named Vulnerability: GHSA-q4r8-xm5f-56gw

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.00308