CVE-2025-44005
Critical · 10.0CVSS
10.0
EPSS
9.1%
Published
Dec 17, 2025
CISA due date
—
The record
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/smallstep/certificates | 0 | 0.29.0 |
| Chainguard | caddy | 0 | 2.10.2-r6 |
| Chainguard | caddy-fips | 0 | 2.10.2-r6 |
| Chainguard | caddy-man | 0 | 2.10.2-r6 |
| Chainguard | caddy-src | 0 | 2.10.2-r6 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| Wolfi | caddy | 0 | 2.10.2-r6 |
| Wolfi | caddy-man | 0 | 2.10.2-r6 |
| Wolfi | caddy-src | 0 | 2.10.2-r6 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
Related vulnerabilities
- CVE-2025-66406 Step CA is an online certificate authority for secure, automated certificate management… Also affects github.com/smallstep/certificates
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects caddy
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects caddy
- CVE-2026-30836 Step CA is an online certificate authority for secure, automated certificate management… Also affects caddy
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects caddy
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects caddy
- CVE-2026-25793 Nebula is a scalable overlay networking tool. Also affects caddy
- CVE-2025-64702 quic-go is an implementation of the QUIC protocol in Go. Also affects caddy