smallstep CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW smallstep CVE published 2026-04-10

CVE-2026-40097

A vulnerability in Step CA, an online certificate authority for secure, automated certificate management for DevOps, allows an attacker to trigger an index out-of-bounds panic by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. This issue affects versions from 0.24.0 to before 0.30.0-rc3 and is fixed in 0.30.0-rc3. The vulne [truncated]