Step CA CVE-2026-30836

Immediately upgrade to Smallstep Certificates version 0.30.0 or later, available at https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7 (release candidate) with final production release at v0.30.0. The fix is implemented in Git commit e6da031d5125cfd99fe9a26f74bb41e4dacca4ef. Organizations unable to patch immediately should implement the following compensating controls with noted trade-offs: restrict network access to Step CA endpoints to only trusted IP ranges or VPN-connected clients using firewall rules (reduces attack surface but does not prevent exploitation by attackers who gain access to trusted networks); implement additional network-layer authentication such as mutual TLS for all CA API connections (adds defense-in-depth but requires client certificate distribution and may break automated certificate renewal workflows); enable comprehensive audit logging and monitor for unexpected certificate issuance patterns or authentication attempts (provides detection capability but does not prevent initial compromise); consider temporarily taking Step CA offline for non-essential certificate operations until patching is complete (eliminates exposure but disrupts certificate lifecycle management). Note that due to embargoed disclosure, specific vulnerable code paths are unknown, making targeted workarounds impossible to recommend. Consult vendor advisory at https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw or contact security@smallstep.com for urgent guidance.