CVE-2026-30836: smallstep certificates Improper Authentication
CVSS: 10.0v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-30836CGA-85cx-9qr7-ww8xCGA-wph6-6hjp-cg4wGHSA-q4r8-xm5f-56gwGO-2026-4775CGA-256r-53rr-24cwCGA-482f-v482-f6h4CGA-75ph-vpmm-h5rcCGA-7h86-82x6-2793CGA-ff75-gjx5-67j9CGA-fg88-57fv-pfg7CGA-g38m-r4p5-m4v9CGA-g3fm-fh88-h633CGA-jxw9-p2jf-2q93CGA-m87g-9g35-r4mmCGA-pv83-g9mm-5mp5CGA-whgf-m443-26j5CGA-xxm9-9hf7-5v2j
Published 19-03-2026Last modified 25-03-2026
Vulnerability summary
CVE-2026-30836 is a critical (CVSS 10.0) Improper Authentication vulnerability in smallstep certificates. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.5% of scored vulnerabilities.
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)EPSS score
0.32%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 19-03-2026PublishedVulnerability first disclosed.
- 25-03-2026Last modifiedVulnerability information updated.
Description
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 10.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- OSV · GoEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
+0.02 pp
From 0.30% on 19-09-2026
19-09-202619-10-2026
EPSS score0.32%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- caddy< 2.11.2-r7
- caddy-fips< 2.11.2-r3
- frankenphp-8.2< 1.12.1-r2
- frankenphp-8.3< 1.12.1-r2
- frankenphp-8.4< 1.12.1-r2
Smallstep2 products
- certificates< 0.30.0
- step-ca< 0.30.0 | 0.30.0:rc1 | 0.30.0:rc2 | 0.30.0:rc3 | 0.30.0:rc4 | 0.30.0:rc5 | 0.30.0:rc6
Github.com/smallstep1 product
- certificates< 0.30.0
Ubuntu1 product
- golang-github-smallstep-certificatesAll versions (No fix recorded)
Wolfi1 product
- caddy< 2.11.2-r7
5 vendors · 13 products
References
8 links- github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gwX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4efX Refsource MISCREPORTFIXWEBPatch
