GHSA-q4r8-xm5f-56gw: github.com/smallstep/certificates fixed in 0.30.0

GHSA-q4r8-xm5f-56gw PUBLISHED CVSS 10 CRITICAL

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Record from GitHub Advisory Database · Published March 19, 2026

github.com/smallstep/certificates is fixed in 0.30.0 (Go Modules)

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/smallstep/certificates	Go Modules	0.30.0
frankenphp-8.4	Chainguard	1.12.1-r2
caddy	Chainguard	2.11.2-r7
frankenphp-8.5	Chainguard	1.12.1-r2
caddy-fips	Chainguard	2.11.2-r3
caddy	Wolfi	2.11.2-r7
step-issuer-fips	Chainguard	0.9.11-r10
frankenphp-8.3	Chainguard	1.12.1-r2
frankenphp-8.2	Chainguard	1.12.1-r2
step-ca-fips	Chainguard	0.30.2-r0

Risk scores

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

Vendor	Product	Versions
chainguard	frankenphp-8.4	0
chainguard	caddy	0
chainguard	frankenphp-8.5	0
chainguard	caddy-fips	0
wolfi	caddy	0
chainguard	step-issuer-fips	0
chainguard	frankenphp-8.3	0
chainguard	frankenphp-8.2	0
chainguard	step-ca-fips	0
github.com	smallstep/certificates	0

Timeline

Mar 19, 2026 CVE Published
Apr 26, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-q4r8-xm5f-56gw
vulnetix vdb fixes GHSA-q4r8-xm5f-56gw

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-q4r8-xm5f-56gw/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →