CVE-2025-44005 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2025-44005 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability, identified as CVE-2025-44005, has been discovered in Step CA affecting deployments configured with ACME and/or SCEP provisioners. This vulnerability has a CVSS score of 10, indicating severe risk. Although there is currently no evidence of exploitation in the wild, all operators using these provisioners are urged to upgrade to the latest release v0.29.0 immediately to mitigate potential risks.

Immediate Action

  • Upgrade your Step CA to version v0.29.0 or later without delay.
  • If unable to upgrade immediately, consider isolating the service to limit exposure.
  • Review your configuration for any use of ACME or SCEP provisioners.
  • Stay tuned for a full write-up in the coming weeks for more technical details.
  • Visit this link to join the embargo list for advance notifications on security updates.

Affected Versions

  • github.com/smallstep/certificates@<=v0.28.9 vulnerable; upgrade to v0.29.0+

Resolution Guide

To upgrade your Step CA, use the following commands:

go get github.com/smallstep/certificates@v0.29.0

For Docker users, pull the latest image:

docker pull smallstep/certificates:v0.29.0

Ensure your configuration is updated to follow best practices. For example, review and harden your ACME/SCEP settings.

Example configuration snippet (ensure you have proper access controls):

acme:
  enabled: true
  # Ensure secure access
  accessControl: "strict"

Detection & Verification

To check if your current version is vulnerable, run:

go list -m all | grep github.com/smallstep/certificates

To verify that the upgrade was successful, use:

go list -m all | grep github.com/smallstep/certificates

Risk and Impact

This vulnerability could allow an attacker to exploit misconfigured deployments, potentially leading to unauthorized access to sensitive information or control over certificate issuance. The blast radius includes any service relying on ACME or SCEP provisioners, putting critical infrastructure at risk.

Stay vigilant and prioritize this upgrade to protect your projects and users.

```

Keep reading