CVE-2026-30836

Name of the Vulnerable Software and Affected Versions Step CA versions 0.30.0-rc6 and below

Description Step CA is an online certificate authority designed for secure, automated certificate management. A flaw exists where the software does not adequately protect against unauthenticated certificate issuance through the SCEP UpdateReq (MessageType=18). This allows attackers to potentially obtain valid certificates for any domain without providing credentials. The SCEP UpdateReq bypasses all authentication checks within Step CA.

Recommendations Versions prior to 0.30.0 should be upgraded to version 0.30.0.