VULNERABILITY INTELLIGENCE

CVE-2025-66406

CVSS score5 MEDIUM
EPSS probability0.15%
CISA KEVNot currently listed
Published2025-12-03
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Description

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

Weakness classification

  • security-advisories@github.com: CWE-863

Primary references