CVE-2025-44005 Step CA Has Authorization Bypass in ACME and SCEP Provisioners
Attackers can bypass authorization checks to force Step CA to issue certificates without completing required protocol validations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-44005?
CVE-2025-44005 is a critical authentication bypass vulnerability in smallstep Step-CA, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
Weakness: CWE-287
Which versions are affected by CVE-2025-44005?
3 open source packages ship an affected version, including github.com/smallstep/certificates.
| Package | Affected | Fixed in |
|---|---|---|
github.com/smallstep/certificates Go | All versions | 0.29.0 |
github.com/smallstep/certificates Go | All versions | 0.29.0 |
github.com/smallstep/certificates Go | All versions | 0.29.0 |
How do I fix CVE-2025-44005?
Upgrade github.com/smallstep/certificates to 0.29.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-44005 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44005 exists.
Sources
Also known as CLEANSTART-2026-ZH50133, CLEANSTART-2026-ZR04706, GHSA-h8cp-697h-8c8p, GO-2025-4180, MINI-3262-qw8f-6w4w.