Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Step CA is an online certificate authority for secure, automated certificate management for DevOps.
    Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the     SCEP UpdateReq. This issue has been fixed in version 0.30.0. (CVE-2026-30836)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Step CA is an online certificate authority for secure, automated certificate management for DevOps.
    Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the
    SCEP UpdateReq. This issue has been fixed in version 0.30.0. (CVE-2026-30836)

ID	Name	Product	Family	Severity
303466	Linux Distros Unpatched Vulnerability : CVE-2026-30836	Nessus	Misc.	critical
439097	SCA: security update for github.com/smallstep/certificates (GHSA-q4r8-xm5f-56gw)	Tenable Cloud Security	SCA Checks	critical
439097	SCA: security update for github.com/smallstep/certificates (GHSA-q4r8-xm5f-56gw)	Tenable Self-Hosted Container Security	SCA Checks	critical
439035	Alpine: multiple step-certificates packages: security update to 0.30.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
439035	Alpine: multiple step-certificates packages: security update to 0.30.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2026-30836

critical

Tenable Plugins

critical

critical

critical

critical

critical