Most recent entries from all

Withdrawn: CLEANSTART-2026-KV78041 — processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

2026-10-03T07:48:36.437348+00:00

Withdrawn by the publisher.

Affected: CleanStart: step-issuer-fips

Multiple security vulnerabilities affect the step-issuer-fips package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. See references for individual vulnerability details.

EUVD-2026-263861

2026-10-03T07:48:36.437401+00:00

EUVD-2026-263861

fkie_cve-2025-44005

2026-10-03T07:48:36.437417+00:00

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

GHSA-h8cp-697h-8c8p — Step CA Has Authorization Bypass in ACME and SCEP Provisioners

2026-10-03T07:48:36.437439+00:00

Affected: Go: github.com/smallstep/certificates

## Summary

A security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with ACME and/or SCEP provisioners. All operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.

The issue was discovered and disclosed by a research team during a security review. There is no evidence of active exploitation.

To limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.

---

## Embargo List

If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.

---

## Acknowledgements

This issue was identified and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)

---

Stay safe, and thank you for helping us keep the ecosystem secure.