CVE-2026-30836

Katalog CVE

CVSS 10.0 · Critical EPSS 0,31%

Kerentanan Improper Authentication pada smallstep step-ca. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw advisory vendor
• https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef patch
• https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7 release notes