UBUNTU-CVE-2026-30836

CRITICAL10.0

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through

Published Mar 19, 2026

Modified 2 weeks ago

Details

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

Affected Packages

golang-github-smallstep-certificates

Ubuntu 24.04 LTS

Affected versions:

0.19.0-1

golang-github-smallstep-certificates

Ubuntu 25.10

Affected versions:

0.19.0-10.20.0-5

References

REPORT

https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef