github.com/smallstep/certificates
Go4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/smallstep/certificatespage 1 of 1
- CVE-2025-44005CRITICALCVSS 10.0EG 10.0✓ Fixed in 0.29.02025-12-17
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
- CVE-2025-66406MEDIUMCVSS 5.0EG 5.0✓ Fixed in 0.29.02025-12-03
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHP…
- CVE-2026-30836CRITICALCVSS 10.0EG 10.0✓ Fixed in 0.30.02026-03-19
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been…
- CVE-2026-40097LOWCVSS 3.7EG 3.7✓ Fixed in 0.30.02026-04-10
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK)…
Check whether github.com/smallstep/certificates is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/smallstep/certificates CVEs against the assets you own.
Start Free Scan →