Unauthenticated Certificate Issuance Vulnerability in Step CA from Smallstep
CVE-2026-30836

10CRITICAL

Key Information:

Vendor

Smallstep

Status
Certificates
Vendor
CVE Published:
19 March 2026

What is CVE-2026-30836?

Step CA, an online certificate authority designed for secure, automated certificate management within DevOps environments, is exposed to a vulnerability that allows unauthenticated certificate issuance via the SCEP UpdateReq mechanism. This flaw is present in versions up to and including 0.30.0-rc6. Users of these versions are strongly advised to update to version 0.30.0 to mitigate this risk and ensure secure certificate management practices.

Affected Version(s)

certificates < 0.30.0

References

https://github.com/smallstep/certificates/security/adviso...
x_refsource_CONFIRM
https://github.com/smallstep/certificates/commit/e6da031d...
x_refsource_MISC
https://github.com/smallstep/certificates/releases/tag/v0...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.