CVE-2026-30836
Critical · 10.0CVSS
10.0
EPSS
0.3%
Published
Mar 19, 2026
CISA due date
—
The record
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | caddy | 0 | 2.11.2-r7 |
| Chainguard | caddy-fips | 0 | 2.11.2-r3 |
| Chainguard | frankenphp-8.2 | 0 | 1.12.1-r2 |
| Chainguard | frankenphp-8.3 | 0 | 1.12.1-r2 |
| Chainguard | frankenphp-8.4 | 0 | 1.12.1-r2 |
| Chainguard | frankenphp-8.5 | 0 | 1.12.1-r2 |
| Chainguard | step-ca-fips | 0 | 0.30.2-r0 |
| Chainguard | step-issuer-fips | 0 | 0.9.11-r10 |
| Wolfi | caddy | 0 | 2.11.2-r7 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260326T203309-150000.1.155.2 |
Related vulnerabilities
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects caddy
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects caddy
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects caddy
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects caddy
- CVE-2026-25793 Nebula is a scalable overlay networking tool. Also affects caddy
- CVE-2025-44005 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner… Also affects caddy
- CVE-2025-64702 quic-go is an implementation of the QUIC protocol in Go. Also affects caddy
- CVE-2025-66406 Step CA is an online certificate authority for secure, automated certificate management… Also affects caddy