CVE-2026-40097: Smallstep Step CA index out-of-bounds panic in TPM attestation

Executive brief

Smallstep Step CA is a certificate authority used to manage secure identities for devices and services. A vulnerability in its TPM device attestation process allows a remote attacker to crash the service by providing a specially crafted certificate. This results in a denial-of-service, preventing the system from issuing or renewing certificates until it is restarted.

Technical details

An index out-of-bounds vulnerability exists in Step CA's TPM attestation EKU validation logic. When processing a 'device-attest-01' ACME challenge, the `validateAKCertificateExtendedKeyUsage` function decodes the ASN.1 representation of the Extended Key Usage (EKU) extension. If a crafted certificate contains an EKU extension that decodes to an empty sequence, the code attempts to access the first element of the empty slice, triggering a Go panic. This vulnerability is only reachable if TPM device attestation is enabled. The issue is fixed in version 0.30.0 by adding a proper bounds check.

Affected products

• Smallstep certificates >= 0.24.0, < 0.30.0

Timeline

• 2026-04-10: disclosed
• 2026-04-10: advisory
• 2026-04-10: patched: Fixed in version 0.30.0

References

• https://api.github.com/users/1seal
• https://github.com/1seal
• https://api.github.com/users/1seal/gists%7B/gist_id%7D
• https://api.github.com/users/1seal/repos
• https://avatars.githubusercontent.com/u/239602944?v=4
• https://api.github.com/users/1seal/events%7B/privacy%7D