EUVD-2026-13200
GHSA-q4r8-xm5f-56gw
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4Description
⚠️ **Limited Disclosure - Full Details Pending** A critical security vulnerability has been identified in Step CA. An updated version, v0.30.0, is available and all operators are strongly encouraged to upgrade immediately. Full details of this vulnerability will be published in this security advisory on March 30, 2026. If you have urgent questions in the meantime, please contact [[email protected]](mailto:[email protected]).
Analysis
A critical authentication bypass vulnerability exists in Step CA, an open-source certificate authority, that allows remote unauthenticated attackers to completely bypass authentication mechanisms and gain unauthorized access with high privileges. The vulnerability affects all versions prior to v0.30.0 and has been assigned the maximum CVSS score of 10.0, indicating extreme severity with potential for both confidentiality and integrity compromise across security boundaries. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all Step CA deployments and isolate instances from untrusted networks; declare security incident status and establish incident response team. Within 7 days: Upgrade all Step CA instances to v0.30.0 or later immediately upon release; conduct certificate audit to identify unauthorized issuance; rotate all CA keys and re-issue critical certificates. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today