Vulnetix
Try Vulnetix Request Demo
CVE-2026-30836 PUBLISHED CVSS 10 CRITICAL

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

EPSS 0.01% · 0.9th percentile

Risk Scores

CVSS v3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score
0.01%
0.9th percentile

Affected Products

VendorProductVersions
github.comsmallstep/certificates0, 0
smallstepcertificates< 0.30.0, < 0.30.0

Timeline

References

Open in Interactive Console →