Vulnerability · Published Mar 19, 2026 · Assigned by GitHub_M
CVE-2026-30836Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
Critical 10.0
In plain English
A critical-severity improper authentication in certificates from smallstep. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.3%top 76.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | step-certificates | 0.30.1-r0 | ALPINE-CVE-2026-30836 |
| Alpine:v3.24 | step-certificates | 0.30.1-r0 | ALPINE-CVE-2026-30836 |
| Go | github.com/smallstep/certificates | 0.30.0 | GHSA-q4r8-xm5f-56gw |
| Go | github.com/smallstep/certificates | 0.30.0 | GO-2026-4775 |
| Ubuntu:24.04:LTS | golang-github-smallstep-certificates | no fix listed | UBUNTU-CVE-2026-30836 |
| Ubuntu:25.10 | golang-github-smallstep-certificates | no fix listed | UBUNTU-CVE-2026-30836 |
| Ubuntu:26.04:LTS | golang-github-smallstep-certificates | no fix listed | UBUNTU-CVE-2026-30836 |
| Ubuntu:26.10 | golang-github-smallstep-certificates | no fix listed | UBUNTU-CVE-2026-30836 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| smallstep | certificates | < 0.30.0 |
Weakness: CWE-287, CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N