CVE-2025-66406

MediumCVSS 5.0

Published: 03/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation, affecting deployments configured with the SSHPOP provisioner.

Risk Assessment

Unauthorized revocation of SSH certificates can disrupt access to infrastructure or allow an attacker to manipulate trust in the DevOps environment.

Recommendation

Update Step CA to version 0.29.0 or later.

Other vulnerabilities in Step CA

CVE-2026-40097Low
Step CA from 0.24.0 to before 0.30.0-rc3 allows an attacker to trigger an index out-of-bounds panic by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage extension during TPM device attestation. The vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured.

Original NVD description (English source)

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS