CVE-2026-30836

{"id": "CVE-2026-30836", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.9}]}, "published": "2026-03-19T21:17:09.783", "references": [{"url": "https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef", "source": "security-advisories@github.com"}, {"url": "https://github.com/smallstep/certificates/releases/tag/v0.30.0-rc7", "source": "security-advisories@github.com"}, {"url": "https://github.com/smallstep/certificates/security/advisories/GHSA-q4r8-xm5f-56gw", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0."}, {"lang": "es", "value": "Step CA es una autoridad de certificaci\u00f3n en l\u00ednea para la gesti\u00f3n de certificados segura y automatizada para DevOps. Las versiones 0.30.0-rc6 e inferiores no protegen contra la emisi\u00f3n de certificados no autenticada a trav\u00e9s de la solicitud SCEP UpdateReq. Este problema ha sido corregido en la versi\u00f3n 0.30.0."}], "lastModified": "2026-03-20T13:39:46.493", "sourceIdentifier": "security-advisories@github.com"}