CVE-2026-40097 smallstep CVE debrief

Who should care

DevOps teams using Step CA with TPM device attestation should verify their version and update to 0.30.0-rc3 or later. This includes teams managing certificate management for DevOps and those using TPM device attestation configurations. These teams should review their configurations and ensure they are properly secured to prevent potential crashes and exploitation attempts.

Why it matters

CVE-2026-40097 vulnerability in Step CA allows index out-of-bounds panic via crafted attestation key certificate, impacting DevOps teams using TPM device attestation.

• Verify Step CA version to prevent potential crashes
• Ensure TPM device attestation configurations are properly secured
• Monitor for potential exploitation attempts targeting vulnerable versions

Technical summary

The vulnerability in Step CA is triggered by a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. This causes an index out-of-bounds panic when processing a device-attest-01 ACME challenge. The vulnerability affects versions from 0.24.0 to before 0.30.0-rc3 and is fixed in 0.30.0-rc3. The vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured. Deployments not using TPM device attestation are not affected.

Defensive priority

Defenders should prioritize verifying their Step CA version and ensuring it is updated to 0.30.0-rc3 or later if TPM device attestation is used.

Recommended defensive actions

• Verify Step CA version and update to 0.30.0-rc3 or later if TPM device attestation is used
• Review device-attest-01 ACME challenge configurations to ensure TPM attestation is properly secured
• Monitor for potential exploitation attempts targeting vulnerable versions
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The fix is available in version 0.30.0-rc3. This issue affects versions from 0.24.0 to before 0.30.0-rc3 and is fixed in 0.30.0-rc3. The vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured. Deployments not using TPM device attestation are not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.