PatchTheCVEsmallstep vulnerabilities
Recent CVEs affecting smallstep products. 1 tracked.
smallstep has 1 tracked vulnerability, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-04-10. Highest priority: CVE-2026-40097 (score 20/100).
- CVE-2026-40097 LOW 3.7 UPGRADE Step CA is an online certificate authority for secure, automated certificate management for DevOps
FAQ
How do I fix smallstep vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is smallstep being exploited right now?
None of the tracked smallstep CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which smallstep CVE should I patch first?
CVE-2026-40097 currently ranks highest (20/100): Step CA is an online certificate authority for secure, automated certificate management for DevOps.