VulnerabilityDeferred

CVE-2025-66406

Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation.

MEDIUM 5.0EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

CVSS 3.1: 5.0 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: security-advisories@github.com

References

https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.