Smallstep vulnerabilities
We track 2 vulnerabilities in Smallstep products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2026.
2vulnerabilities
2critical
0high
0exploited
10.0average CVSS score
Latest Smallstep vulnerabilities
- 10.0 Critical severity
certificates: Improper Certificate Validation
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.3
- 10.0 Critical severity
Step-CA: Improper Authentication
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.