smallstep certificates vulnerabilities

3 published CVEs name smallstep certificates among the affected products.

All 3 in the list Atom feed of new CVEs

Published CVEs: 3
Last 12 months: 3
Critical: 1
Known exploited: 0

Critical 1High 0Medium 1Low 1Not scored 0

CVEs per yearBy the year they were published

20251
20262

Newest CVEs

CVE-2026-40097
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
smallstep · certificates
Low3.7
CVE-2026-30836
Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
smallstep · certificates
Critical10.0
CVE-2025-66406
Improper Authorization Check for SSH Certificate Revocation
smallstep · certificates
Medium5.0

Most common weaknesses