Vulnerability in Smallstep Certificates
CVE-2026-40097
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK)…
EPSS: 0.001 (16.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Smallstep Certificates — versions >= 0.24.0, < 0.30.0-rc3
Weakness classification (CWE)
References
- https://github.com/smallstep/certificates/security/advisories/GHSA-9qq8-cgcv-qmc9 (x_refsource_CONFIRM)
- https://github.com/smallstep/certificates/pull/2569 (x_refsource_MISC)
- https://github.com/smallstep/certificates/commit/ffd31ac0a87e03b0224cb8363094bfe602242888 (x_refsource_MISC)
- https://github.com/smallstep/certificates/releases/tag/v0.30.0 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-40097?
- CVE-2026-40097 is a low-severity vulnerability in Smallstep Certificates, classified under Improper Validation of Array Index. CVSS score: 3.7/10. Published 2026-04-10.
- How severe is CVE-2026-40097?
- Low severity. CVSS v3 base score is 3.7 out of 10.