CVE-2026-40097
published 2026-04-10CVE-2026-40097: Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.18%
7.9th percentile
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. When processing a device-attest-01 ACME challenge using TPM attestation, Step CA validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A crafted certificate could include an EKU extension that decodes to an empty sequence, causing the code to panic when accessing the first element of the empty slice. This vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured. Deployments not using TPM device attestation are not affected. This vulnerability is fixed in 0.30.0-rc3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | smallstep_certificates | >= 0.24.0 < 0.30.0 | 0.30.0 |
| smallstep | certificates | — | — |
| smallstep | step-ca | — | — |
| smallstep | step-ca | >= 0.24.0 < 0.30.0 | 0.30.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
smallstep certificates up to 0.30.0-rc2 array index (GHSA-9qq8-cgcv-qmc9)
vuldb·2026-04-10·CVSS 3.7
CVE-2026-40097 [LOW] smallstep certificates up to 0.30.0-rc2 array index (GHSA-9qq8-cgcv-qmc9)
A vulnerability was found in smallstep certificates up to 0.30.0-rc2. It has been classified as problematic. This impacts an unknown function. This manipulation causes improper validation of array index.
This vulnerability appears as CVE-2026-40097. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
ghsa·2026-04-10
CVE-2026-40097 [LOW] CWE-129 Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
# Summary
An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation.
## Details
When processing a device-attest-01 ACME challenge using TPM attestation, Step CA validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A crafted certificate could include an EKU extension that decodes to an empty sequence, causing the code to panic when accessing the first element of the empty slice.
This vulnerability is only re
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [fedora-all]
bugzilla·2026-06-11·CVSS 3.7
CVE-2026-40097 [LOW] CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [fedora-all]
CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [fedora-all]
+++ This bug was initially created as a clone of Bug #2457925 +++
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [epel-all]
bugzilla·2026-04-13·CVSS 3.7
CVE-2026-40097 [LOW] CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [epel-all]
CVE-2026-40097 caddy: Step CA: Denial of Service via crafted attestation key certificate [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-40097 github.com/smallstep/certificates: Step CA: Denial of Service via crafted attestation key certificate
bugzilla·2026-04-10·CVSS 3.7
CVE-2026-40097 [LOW] CVE-2026-40097 github.com/smallstep/certificates: Step CA: Denial of Service via crafted attestation key certificate
CVE-2026-40097 github.com/smallstep/certificates: Step CA: Denial of Service via crafted attestation key certificate
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. When processing a device-attest-01 ACME challenge using TPM attestation, Step CA validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A crafted certificate could include an EKU extension
2026-04-10
Published