CVE-2025-66406
Medium · 5.0CVSS
5.0
EPSS
0.2%
Published
Dec 3, 2025
CISA due date
—
The record
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/smallstep/certificates | 0 | 0.29.0 |
| Chainguard | caddy | 0 | 2.10.2-r6 |
| Chainguard | caddy-fips | 0 | 2.10.2-r6 |
| Chainguard | caddy-man | 0 | 2.10.2-r6 |
| Chainguard | caddy-src | 0 | 2.10.2-r6 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| Wolfi | caddy | 0 | 2.10.2-r6 |
| Wolfi | caddy-man | 0 | 2.10.2-r6 |
| Wolfi | caddy-src | 0 | 2.10.2-r6 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
Related vulnerabilities
- CVE-2025-44005 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner… Also affects github.com/smallstep/certificates
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects caddy
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects caddy
- CVE-2026-30836 Step CA is an online certificate authority for secure, automated certificate management… Also affects caddy
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects caddy
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects caddy
- CVE-2026-25793 Nebula is a scalable overlay networking tool. Also affects caddy
- CVE-2025-64702 quic-go is an implementation of the QUIC protocol in Go. Also affects caddy