What’s Vulnerable › Products

smallstep Step-CA vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your smallstep Step-CA version is affected

Latest smallstep Step-CA vulnerabilities

• CVE-2026-40097 — Step CA affected by an index out of bounds panic in TPM attestation EKU validation (CVSS 3.7)
• CVE-2026-30836 — Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) (CVSS 10.0)
• CVE-2025-44005 — Step CA Has Authorization Bypass in ACME and SCEP Provisioners (CVSS 10.0)