Smallstep - vulnerabilities (CVEs)

4 CVEs in 2 products, 0 in the last 30 days, newest from 2026-04-10.

Products

• Certificates - 3 CVEs
• Step-ca - 2 CVEs

Newest CVEs of Smallstep

• CVE-2026-40097 - CVSS 3.7 (low), 2026-04-10: Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger…
• CVE-2026-30836 - CVSS 10 (critical), 2026-03-19: Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against…
• CVE-2025-44005 - CVSS 10 (critical), 2025-12-17: An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol…
• CVE-2025-66406 - CVSS 5 (medium), 2025-12-03: Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check…