LOW3.7Go
GHSA-9qq8-cgcv-qmc9· CVE-2026-40097, GO-2026-5297Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Modified: 6/25/2026
package
Go/github.com/smallstep/certificates
pkg:go/github.com/smallstep/certificates
CRITICAL10.0Go
GHSA-h8cp-697h-8c8p· CVE-2025-44005, GO-2025-4180Step CA Has Authorization Bypass in ACME and SCEP Provisioners
Modified: 9/10/2026
MEDIUM5.0Go
GHSA-j7c9-79x7-8hpr· CVE-2025-66406, GO-2025-4181step-ca Has Improper Authorization Check for SSH Certificate Revocation
Modified: 9/10/2026
CRITICAL10.0Go
GHSA-q4r8-xm5f-56gw· CVE-2026-30836, GO-2026-4775step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
Modified: 9/10/2026
—Go
GO-2025-4180· CVE-2025-44005, GHSA-h8cp-697h-8c8pStep CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates
Modified: 2/4/2026
—Go
GO-2025-4181· CVE-2025-66406, GHSA-j7c9-79x7-8hprstep-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates
Modified: 2/4/2026
—Go
GO-2026-4775· CVE-2026-30836, GHSA-q4r8-xm5f-56gwstep-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates
Modified: 3/31/2026
—Go
GO-2026-5297· CVE-2026-40097, GHSA-9qq8-cgcv-qmc9Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates
Modified: 6/25/2026