Vendors / smallstep Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 0
Exploited now smallstep records in CISA KEV No smallstep vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.09091 · Published 2025-12-17 · Fixed in 0.29.0 CWE-287
Priority MEDIUM 49
Step CA is an online certificate authority for secure, automated certificate management for DevOps.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00308 · Published 2026-03-19 · Fixed in 0.30.0 CWE-287
Priority LOW 22
Step CA is an online certificate authority for secure, automated certificate management for DevOps.
CVSS 3.1 MEDIUM 5.0· Network · High privileges · No interaction · EPSS 0.00162 · Published 2025-12-03 · Fixed in 0.29.0 CWE-863
Priority LOW 17
Step CA is an online certificate authority for secure, automated certificate management for DevOps.
CVSS 3.1 LOW 3.7· Network · No auth · No interaction · EPSS 0.00188 · Published 2026-04-10 · Fixed in 0.30.0-rc3, 0.30.0 CWE-129
Open these records in search → All records by CVSS severity
2 0 1 1 0
