CVE-2026-30836

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287",
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30836.json"
}

References

Affected packages

Git / github.com/smallstep/certificates

Affected ranges

Type

GIT

Repo

https://github.com/smallstep/certificates

Events

Introduced

Fixed

d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.30.0"
        }
    ]
}

Affected versions

v0.*

v0.0.1-rc.2

v0.10.0

v0.11.0

v0.11.0-rc.1

v0.11.0-rc.2

v0.11.0-rc.3

v0.11.0-rc.4

v0.12.0

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.0-rc.1

v0.14.0-rc.14

v0.14.0-rc.16

v0.14.0-rc.2

v0.14.0-rc.3

v0.14.0-rc.5

v0.14.0-rc.6

v0.14.0-rc.7

v0.14.0-rc.8

v0.14.0-rc.9

v0.14.1

v0.14.2

v0.14.3

v0.14.4

v0.14.5

v0.14.5-rc.4

v0.14.6

v0.14.7-rc.1.docker-buildx

v0.14.7-rc.2.deb-name-test

v0.15.0

v0.15.0-rc.1

v0.15.1

v0.15.1-rc.1

v0.15.10

v0.15.11

v0.15.12

v0.15.12-rc1

v0.15.12-rc2

v0.15.12-rc3

v0.15.12-rc4

v0.15.12-rc5

v0.15.13

v0.15.14

v0.15.15

v0.15.16

v0.15.16-rc1.test-arm6

v0.15.16-rc2.test-arm6

v0.15.16-rc3.test-arm6

v0.15.16-rc4

v0.15.16-rc5

v0.15.16-rc7

v0.15.2

v0.15.2-rc.1

v0.15.3

v0.15.4

v0.15.5

v0.15.6

v0.15.7

v0.15.7-rc.1

v0.15.8

v0.15.9

v0.15.9-rc1

v0.15.9-rc10

v0.15.9-rc11

v0.15.9-rc12

v0.15.9-rc13

v0.15.9-rc14

v0.15.9-rc15

v0.15.9-rc16

v0.15.9-rc17

v0.15.9-rc19

v0.15.9-rc2

v0.15.9-rc3

v0.15.9-rc4

v0.15.9-rc5

v0.15.9-rc6

v0.15.9-rc7

v0.15.9-rc8

v0.15.9-rc9

v0.16.0

v0.16.0-rc.1

v0.16.0-rc.2

v0.16.1

v0.16.2

v0.16.3

v0.16.4

v0.17.0

v0.17.0-rc1

v0.17.1

v0.17.2

v0.17.2-rc1

v0.17.3

v0.17.3-rc1

v0.17.3-rc2

v0.17.3-rc3

v0.17.3-rc4

v0.17.3-rc5

v0.17.3-rc6

v0.17.3-rc7

v0.17.3-rc8

v0.17.3-rc9

v0.17.4

v0.17.4-rc1

v0.17.5

v0.17.5-rc1

v0.17.6

v0.17.6-rc2

v0.18.0

v0.18.1

v0.18.1-rc1

v0.18.1-rc2

v0.18.1-rc3

v0.18.2

v0.18.3-rc1

v0.19.0

v0.20.0

v0.21.0

v0.22.0

v0.22.1

v0.22.2-rc13

v0.22.2-rc14

v0.23.0

v0.23.0-rc.1

v0.23.0-rc.2

v0.23.0-rc.3

v0.23.1

v0.23.1-rc.1

v0.23.2

v0.24.0

v0.24.0-rc.2

v0.24.0-rc1

v0.24.1

v0.24.2

v0.24.3-rc.1

v0.24.3-rc.2

v0.24.3-rc.3

v0.24.3-rc.4

v0.24.3-rc.5

v0.25.0

v0.25.1

v0.25.2

v0.25.3-rc.1

v0.25.3-rc2

v0.25.3-rc4

v0.25.3-rc5

v0.25.3-rc6

v0.25.3-rc7

v0.26.0

v0.26.0-rc1

v0.26.0-rc2

v0.26.1

v0.26.2

v0.27.0

v0.27.1

v0.27.2

v0.27.3

v0.27.4

v0.27.5

v0.28.0

v0.28.1

v0.28.2

v0.28.3-rc1

v0.28.3-rc2

v0.28.4

v0.29.0

v0.30.0-rc1

v0.30.0-rc2

v0.30.0-rc3

v0.30.0-rc4

v0.8.1

v0.8.1-rc.1

v0.8.1-rc.2

v0.8.2

v0.8.2-rc.1

v0.8.3

v0.8.4

v0.8.4-rc.1

v0.8.4-rc.2

v0.8.5

v0.8.5-rc.5

v0.9.0

v0.9.0-rc.1

v0.9.1

v0.9.1-rc.1

v0.9.1-rc.2

v0.9.2

v0.9.2-rc.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-30836.json"