PT-2026-26343 · Smallstep+1 · Certificates+1

Prasanthsundararajan69 · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-30836

OSV

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

⚠️ Limited Disclosure — Full Details Pending

A critical security vulnerability has been identified in Step CA. An updated version, v0.30.0, is available and all operators are strongly encouraged to upgrade immediately.

Full details of this vulnerability will be published in this security advisory on March 30, 2026. If you have urgent questions in the meantime, please contact [e-mail].

Fix

Improper Certificate Validation

Improper Authentication

Weakness Enumeration

CWE-295

CWE-287

Related Identifiers

CVE-2026-30836

GHSA-Q4R8-XM5F-56GW

Affected Products

Certificates

Github.Com/Smallstep/Certificates

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-30836 · Security Note
• https://osv.dev/vulnerability/GHSA-q4r8-xm5f-56gw · Vendor Advisory
• https://github.com/smallstep/certificates · Note
• https://twitter.com/TheHackerWire/status/2034750791291215968 · Twitter Post
• https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef · Note
• https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7 · Note
• https://twitter.com/CveFindCom/status/2034747506433618018 · Twitter Post
• https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw · Note
• https://twitter.com/0dayPublishing/status/2034735197539672232 · Twitter Post