PT-2025-48988 · Step Ca · Step Ca

CVE-2025-66406 · Publicado 2025-12-03 · Atualizado 2026-01-30

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Step CA versions prior to 0.29.0

Description Step CA is an online certificate authority for secure, automated certificate management for DevOps. A flaw exists in the authorization check for SSH certificate revocation, specifically impacting deployments configured with the SSHPOP provisioner. This issue allows for potential unauthorized actions related to SSH certificate revocation.

Recommendations Update to version 0.29.0 or later.

Exploit

Correção

Improper Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-285

CWE-863

Identificadores relacionados

CLEANSTART-2026-KV78041

CVE-2025-66406

GHSA-J7C9-79X7-8HPR

GO-2025-4181

SUSE-SU-2025:4395-1

Produtos afetados

Step Ca

Referências · 86

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66406.json · Exploit
• https://github.com/smallstep/certificates · Nota
• https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KV78041 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KV78041.json · Nota
• https://suse.com/security/cve/CVE-2017-18875 · Nota
• https://osv.dev/vulnerability/CVE-2025-66406 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-13353 · Nota
• https://suse.com/security/cve/CVE-2025-60638 · Nota
• https://suse.com/security/cve/CVE-2017-18877 · Nota
• https://osv.dev/vulnerability/CVE-2025-47914 · Nota
• https://suse.com/security/cve/CVE-2025-65105 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-61727 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1pevkbf/resumen_diario_de_vulnerabilidades_05122025 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58185 · Nota de Segurança