CVE-2026-30836CWE-287CWE-295

Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Critical · published March 19, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.8th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-295 · Improper Certificate Validation
Published
2026-03-19T20:37Z
EPSS history
Timeline
  • 19 MAR 20:37Z
    Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
    cvelistv5