VDB
GO-2026-4775
GO-2026-4775
PUBLISHED
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | step-ca-fips | 0, 0 |
| github.com | smallstep/certificates | 0, 0 |
| chainguard | step-issuer-fips | 0, 0 |
| chainguard | frankenphp-8.2 | 0, 0 |
| chainguard | frankenphp-8.5 | 0, 0 |
| chainguard | caddy | 0, 0 |
| chainguard | frankenphp-8.3 | 0, 0 |
| chainguard | frankenphp-8.4 | 0, 0 |
| chainguard | caddy-fips | 0, 0 |
| wolfi | caddy | 0, 0, 0 |
Timeline
- Mar 23, 2026 CVE Published
- Mar 31, 2026 CVE Updated
- May 18, 2026 Security Advisory
References
- https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-30836 advisory
- https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef fix
- https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7 fix